The conduct of nearly all modern scientific research depends on software, yet the systems through which research software is developed, shared, and deployed—its supply chain—remain vulnerable to cyber threats. These Research Software Supply Chains (RSSCs) are complex networks of tools, libraries, collaborators, and institutional processes, and they form a critical foundation for the U.S. research enterprise. However, there is no shared understanding of what these supply chains look like or how to protect them. This project will initiate a coordinated planning effort, called CROSS (Community around Securing the Research Software Supply Chain), to bring together researchers, research software engineers, and government stakeholders to identify and mitigate risks to RSSC security. Through community workshops, empirical studies, and a comprehensive review of existing knowledge, this effort will produce a roadmap for securing the RSSC—helping to safeguard the integrity of scientific knowledge, promote national security, and support the development of a resilient research ecosystem. The project will also engage undergraduate students at Purdue and Loyola, supporting workforce development in cybersecurity and research software engineering. This planning project will develop foundational knowledge to guide future efforts in securing the research software supply chain. The research team will (1) conduct a systematic literature review to synthesize current knowledge into a conceptu