32 docs tagged with "supply-chain"

Reinforced recommendations for critical contexts or environments with high maturity

Organisational policy that defines the treatment of AI models, datasets, MCP servers/tools, embedded prompts and AI providers as an auditable supply chain — AI BOM generation per build in a standardised format (CycloneDX 1.6 ml-bom), version pinning, a list of approved providers and response to upstream incidents, complementing Policy 10 (dependencies) and Policy 11 (SBOM), proportionate to the criticality level (L1, L2, L3).

Organisational policy that defines the requirements for operating automatic dependency update bots, including auto-merge criteria, impact analysis, human handoff and configuration proportional to the application's criticality level (L2, L3).

Binary and auditable checklist to assess the practical adoption of the practices prescribed in Chapter 09 - Containers and Images

Binary verification of the application of the practices prescribed in Chapter 05

Generation, versioning and use of SBOMs as evidence of composition, not as proof of security

Canonical catalogue of security requirements for containers and images (CNT-001 to CNT-012), with applicability by risk level and acceptance criteria for the selection of base images, hardening, signing, scanning, runtime policies and access to registries.

Principles, practices and controls for building, validating and running images in a secure, auditable and traceable way

Organisational policy that defines the criteria, the formal process, the approval authorities, the compensating controls and the reassessment deadlines applicable to exceptions to known vulnerabilities (CVEs) in software dependencies, proportional to the application's criticality level (L1, L2, L3).

Principles, practices and controls to guarantee secure dependency management, SBOM generation and automated software composition analysis

Canonical catalogue of security requirements for the management of third-party dependencies (DEP-001 to DEP-010), with applicability by risk level and acceptance criteria for SBOM, SCA, library governance and update policies.

Generation and management of a Software Bill of Materials (SBOM) with traceability across the lifecycle

Organisational policy that defines the criteria for approving, pinning, blocking, auditing and updating external dependencies in software projects, proportional to the application's criticality level (L1, L2, L3), with a focus on reducing supply chain risk and ensuring traceability.

Practices for proactive updating, TTL, locking and secure version management

Prescriptive rules to ensure that security test results are verifiable, reproducible and auditable, with protection of critical assets and separation between automated signal and human decision.

Practices for the control, approval and traceability of external libraries and third-party packages

How to apply the prescribed container security practices throughout the development and operations lifecycle

Practical integration of the dependency management, SBOM generation and SCA execution prescriptions throughout the application lifecycle

Validation of the provenance and integrity of container images as technical evidence, not as an execution decision

Canonical catalogue of security requirements for IaC projects (IAC-001 to IAC-013), organised by risk level, with acceptance criteria for the governance of repositories, pipelines, state, modules and configuration drift.

Automated integration of SBOM, SCA and exception control into the build and release cycle

Technical and operational indicators for the assessment of the effectiveness of the controls for dependency management, SBOM generation and software composition analysis, with thresholds per risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Prescriptive practices for the governance, validation and control of reusable modules in IaC, ensuring security, provenance and traceability.

Organisational policies required to guarantee the security, traceability and governance of containers and images throughout the lifecycle.

Identification and mitigation of the risks introduced by automation in the chain of building, validation and execution of container images

Organisational policy that defines the requirements for the generation, format, signing, provenance, archiving and retention of SBOMs (Software Bill of Materials) in software, container and IaC builds, proportional to the application's criticality level (L1, L2, L3).

Selection, hardening and validation of secure base images for containers

Responsibilities of Suppliers and Third Parties in the SbD-ToE

Types of attack via dependencies and practices for detection and mitigation

Model linking SCA findings, SBOM, backlog and releases

Prescriptive rules for the secure use of automation/assistance in writing and changing IaC, with validations and evidence by risk level

Software Composition Analysis practices to detect, prioritise and mitigate known vulnerabilities