8 docs tagged with "proveniência"

Techniques to generate, sign and validate artefacts with trustworthy provenance, ensuring traceability from build to production.

Principles, practices and controls for building, validating and running images in a secure, auditable and traceable way

Identification and mitigation of the risks introduced by automation in the chain of building, validation and execution of container images

Organisational policy that defines the requirements for the generation, format, signing, provenance, archiving and retention of SBOMs (Software Bill of Materials) in software, container and IaC builds, proportional to the application's criticality level (L1, L2, L3).

Security practices for continuous integration and delivery pipelines, with a focus on automation, traceability and control proportional to risk

Canonical catalogue of security requirements for continuous integration and delivery pipelines (CIC-001 to CIC-010), with applicability by risk level and acceptance criteria for pipeline design, secrets management, runner isolation, artefact integrity and security gates.

Canonical catalogue of security requirements for the deployment process (DPL-001 to DPL-011), with applicability by risk level and acceptance criteria for formal approval, artefact provenance, automated gates, rollback, deployment credentials, staging, post-deployment monitoring, release gates for agentic systems and end-to-end traceability.

Canonical catalogue of security requirements for the development process (DEV-001 to DEV-009), with applicability by risk level and acceptance criteria for code guidelines, linters, formal review, exception management, provenance and traceable annotations.