22 docs tagged with "SBOM"

Reinforced recommendations for critical contexts or environments with high maturity

Binary verification of the application of the practices prescribed in Chapter 05

Generation, versioning and use of SBOMs as evidence of composition, not as proof of security

Policies for internal repositories, proxies, mirrors and provenance validation

Analysis of how SbD-ToE supports the technical core of the Cyber Resilience Act in the context of products with digital elements, with explicit conformity boundaries

Principles, practices and controls to guarantee secure dependency management, SBOM generation and automated software composition analysis

Canonical catalogue of security requirements for the management of third-party dependencies (DEP-001 to DEP-010), with applicability by risk level and acceptance criteria for SBOM, SCA, library governance and update policies.

Generation and management of a Software Bill of Materials (SBOM) with traceability across the lifecycle

Organisational policy that defines the criteria for approving, pinning, blocking, auditing and updating external dependencies in software projects, proportional to the application's criticality level (L1, L2, L3), with a focus on reducing supply chain risk and ensuring traceability.

Practices for managing and validating external dependencies to ensure integrity, currency and security in the code

Practices for proactive updating, TTL, locking and secure version management

Specifics of exception management in the context of SCA/CVE findings

Practices for the control, approval and traceability of external libraries and third-party packages

How to apply the prescribed container security practices throughout the development and operations lifecycle

Practical integration of the dependency management, SBOM generation and SCA execution prescriptions throughout the application lifecycle

Automated integration of SBOM, SCA and exception control into the build and release cycle

Technical and operational indicators for the assessment of the effectiveness of the controls for dependency management, SBOM generation and software composition analysis, with thresholds per risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Organisational policies that support the practical application of this chapter

Organisational policy that defines the requirements for the generation, format, signing, provenance, archiving and retention of SBOMs (Software Bill of Materials) in software, container and IaC builds, proportional to the application's criticality level (L1, L2, L3).

Types of attack via dependencies and practices for detection and mitigation

Model linking SCA findings, SBOM, backlog and releases

Software Composition Analysis practices to detect, prioritise and mitigate known vulnerabilities