Explore how CNCF best practices for software supply chain security were implemented at 3M to enhance their security posture in this conference talk. Learn about the journey to improve code security, including the evangelization of improved security policies and informing various organizational functions. Discover how these best practices were applied to enhance policy, process, procedure, and build across the Software Development Lifecycle, with a focus on securing open-source components. Gain insights into 3M's response to supply chain attacks and vulnerabilities like Log4J, and understand their approach to implementing standards-based Software Bill of Materials (SBOM). The presentation covers topics such as DevSecOps, Joe Biden's Executive Cyber Security Order, the CNCF document, dynamic inventory, and valuable lessons learned throughout the process.