Standards & Frameworks

G.1 Perform compliance

G.1.1 — Organizational security requirements 4e(ix) G.1.3 — Produce attestation 4e(i)(F), 4e(ii), 4e(v) G.1.4 — Deliver provenance 4e(vi), 4e(vii), 4e(x) G.1.5 — Deliver SBOM 4e(vi), 4e(vii), 4e(x)

G.2 Develop security policies

G.2.1 — Upper management support 4e(ix) G.2.2 — Secure SDLC checks 4e(iv), 4e(v) G.2.3 — Roles and responsibilities 4e(ix) G.2.4 — Security code review policy 4e(iv)

G.3 Manage suppliers

G.3.1 — Security-related contract terms 4e(vi)

G.4 Training

G.4.1 — Role-based training 4e(vi) G.4.3 — Gather attack trends 4e(vi), 4e(vii)

G.5 Assess and manage risk

G.5.2 — Track security risks and decisions 4e(v) G.5.4 — Data-informed product decisions 4e(iv), 4e(v)

P.1 Develop security requirements

P.1.1 — Product security requirements 4e(iv) P.1.2 — Software release integrity 4e(iii)

P.2 Build security in

P.2.1 — Security design review 4e(iv), 4e(v), 4e(ix) P.2.2 — Secure coding 4e(iv) P.2.3 — Secure-by-default implementation 4e(iv) P.2.4 — Standard security features 4e(ix) P.2.5 — In-house components 4e(ix)

P.3 Manage component and container choices

P.3.4 — Vetted third-party component and container repositories 4e(iii), 4e(vi), 4e(x)

P.4 Discover vulnerabilities

P.4.1 — Security code review 4e(iv), 4e(v) P.4.2 — Automated security scanning tools 4e(i)(F), 4e(ii), 4e(iii), 4e(v), 4e(vi) P.4.3 — Automated vulnerability detection 4e(iv), 4e(vi), 4e(viii) P.4.4 — Executable security testing 4e(iv), 4e(v) P.4.5 — Regular third-party compliance 4e(iii), 4e(iv), 4e(vi), 4e(x)

E.1 Safeguard artifact integrity

E.1.1 — Safely store release artifacts 4e(iii), 4e(vi), 4e(x) E.1.2 — Version control 4e(i)C, 4e(iii), 4e(iv)

E.2 Safeguard build integrity

E.2.3 — Defensive compilation and build 4e(iv) E.2.4 — CI/CD hosting and automation 4e(iv)

E.3 Secure software development environment

E.3.2 — Environmental separation 4e(i)(A), 4e(i)(B), 4e(i)(C), 4e(i)(D), 4e(i)(E), 4e(i)(F), 4e(ii), 4e(iii), 4e(v), 4e(vi)

D.1 Respond to/disclose vulnerabilities

D.1.1 — Vulnerability analysis 4e(iv), 4e(viii) D.1.2 — Risk-based vulnerability remediation 4e(iv), 4e(v), 4e(viii) D.1.3 — Vulnerability disclosure 4e(viii) D.1.4 — Vulnerability eradication 4e(iv), 4e(viii) D.1.6 — Root cause analysis 4e(ix)

D.2 Monitor intrusions/violations

D.2.1 — System monitoring 4e(vii)

G.1 Perform compliance

G.1.1 — Organizational security requirements SA-15 G.1.2 — Software license conflict CM-10 G.1.3 — Produce attestation SA-15, AU-2, AU-3, AU-12 G.1.4 — Deliver provenance SR-4 G.1.5 — Deliver SBOM SR-4

G.2 Develop security policies

G.2.2 — Secure SDLC checks SA-15 G.2.3 — Roles and responsibilities SA-3 G.2.4 — Security code review policy SA-11 G.2.5 — Asset inventory CM-8, IA-4, PM-5 G.2.6 — Protection of information at rest SC-28

G.3 Manage suppliers

G.3.1 — Security-related contract terms SA-1, SA-4, SI-3, SA-9, SR-4, SR-5, SR-6 G.3.2 — Separation of duties AC-5 G.3.3 — Information disclosure AU-13 G.3.4 — Session audits AU-14 G.3.5 — Notification agreement SR-8

G.4 Training

G.4.1 — Role-based training AT-2, AT-3, SA-16 G.4.2 — Contingency training CP-3, IR-2 G.4.3 — Gather attack trends SI-4, SI-5, RA-5

G.5 Assess and manage risk

G.5.1 — Criticality analysis RA-9 G.5.4 — Data-informed product decisions SA-15

P.1 Develop security requirements

P.1.1 — Product security requirements SA-8, SA-17

P.2 Build security in

P.2.1 — Security design review SA-17 P.2.3 — Secure-by-default implementation SA-5

P.3 Manage component and container choices

P.3.1 — Component and container choice CM-7, SI-3 P.3.4 — Vetted third-party component and container repositories SI-3, SR-3, SR-4, SR-11

P.4 Discover vulnerabilities

P.4.2 — Automated security scanning tools SA-15 P.4.3 — Automated vulnerability detection SA-11, RA-9, SI-7 P.4.4 — Executable security testing SA-11 P.4.5 — Regular third-party compliance SA-4, SA-9, SA-11, SA-15, SR-3

P.5 Manage vulnerable components and containers

P.5.1 — SBOM consumption SR-4 P.5.2 — Dependency update SI-2

E.1 Safeguard artifact integrity

E.1.2 — Version control SA-8, SA-10 E.1.6 — Decommission assets SA-22

E.3 Secure software development environment

E.3.1 — Authentication IA-5, IA-9 E.3.2 — Environmental separation SA-8, SA-15 E.3.3 — Role-based access control AC-2, AC-3, AC-6, AC-17, IA-2 E.3.4 — Information flow enforcement AC-4, SC-8 E.3.5 — Baseline configuration CM-2 E.3.6 — Monitor changes to configuration settings CM-3, CM-6 E.3.7 — Boundary protection SC-7

D.1 Respond to/disclose vulnerabilities

D.1.1 — Vulnerability analysis SA-15 D.1.2 — Risk-based vulnerability remediation SA-5, SA-11 D.1.3 — Vulnerability disclosure SA-15 D.1.4 — Vulnerability eradication SI-2

D.2 Monitor intrusions/violations

D.2.1 — System monitoring CA-7

G.1 Perform compliance

G.1.1 — Organizational security requirements PO.1.1 G.1.3 — Produce attestation PO.3.3 G.1.4 — Deliver provenance PS.3.2 G.1.5 — Deliver SBOM PS.3.2

G.2 Develop security policies

G.2.1 — Upper management support PO.2.3 G.2.2 — Secure SDLC checks PO.4.1 G.2.3 — Roles and responsibilities PO.2.1 G.2.4 — Security code review policy PW.7.1

G.3 Manage suppliers

G.3.1 — Security-related contract terms PO.1.3

G.4 Training

G.4.1 — Role-based training PO.2.2 G.4.3 — Gather attack trends RV.1.1

G.5 Assess and manage risk

G.5.2 — Track security risks and decisions PW.1.2 G.5.4 — Data-informed product decisions PO.4.2

P.1 Develop security requirements

P.1.1 — Product security requirements PO.1.2 P.1.2 — Software release integrity PS.2.1

P.2 Build security in

P.2.1 — Security design review PW.1.1, PW.2.1 P.2.2 — Secure coding PW.5.1 P.2.3 — Secure-by-default implementation PW.9.1, PW.9.2 P.2.4 — Standard security features PW.1.3 P.2.5 — In-house components PW.4.2

P.3 Manage component and container choices

P.3.4 — Vetted third-party component and container repositories PW.4.1

P.4 Discover vulnerabilities

P.4.1 — Security code review PW.7.2 P.4.2 — Automated security scanning tools PO.3.1, PO.3.2 P.4.3 — Automated vulnerability detection RV.1.2 P.4.4 — Executable security testing PW.8.1, PW.8.2 P.4.5 — Regular third-party compliance PW.4.4

P.5 Manage vulnerable components and containers

P.5.2 — Dependency update RV.1.1

E.1 Safeguard artifact integrity

E.1.1 — Safely store release artifacts PS.3.1 E.1.2 — Version control PS.1.1

E.2 Safeguard build integrity

E.2.3 — Defensive compilation and build PW.6.1 E.2.4 — CI/CD hosting and automation PW.6.2 E.2.8 — Hardened and isolated builds PW.6.2

E.3 Secure software development environment

E.3.2 — Environmental separation PO.5.1, PO.5.2

D.1 Respond to/disclose vulnerabilities

D.1.1 — Vulnerability analysis RV.2.1 D.1.2 — Risk-based vulnerability remediation RV.2.2 D.1.3 — Vulnerability disclosure RV.1.3 D.1.4 — Vulnerability eradication RV.3.3 D.1.6 — Root cause analysis RV.3.1, RV.3.2, RV.3.4

G.1 Perform compliance

G.1.1 — Organizational security requirements PO.1.1, PO.1.2 G.1.3 — Produce attestation PO.3.3 G.1.4 — Deliver provenance PS.3.2 G.1.5 — Deliver SBOM PS.3.2

G.2 Develop security policies

G.2.1 — Upper management support PO.2.3 G.2.2 — Secure SDLC checks PO.4.1 G.2.3 — Roles and responsibilities PO.2.1 G.2.4 — Security code review policy PW.7.1

G.3 Manage suppliers

G.3.1 — Security-related contract terms PO.1.3, PW.3.1, PW.3.2, PW.3.3

G.4 Training

G.4.1 — Role-based training PO.2.2 G.4.3 — Gather attack trends RV.1.1

P.1 Develop security requirements

P.1.1 — Product security requirements PO.1.2 P.1.2 — Software release integrity PS.2.1

P.2 Build security in

P.2.1 — Security design review PW.1.1 P.2.2 — Secure coding PW.5.1 P.2.3 — Secure-by-default implementation PW.9.1 P.2.6 — Confirm Integrity of AI model data PW.3

P.3 Manage component and container choices

P.3.4 — Vetted third-party component and container repositories PW.4.1

P.4 Discover vulnerabilities

P.4.1 — Security code review PW.7.2 P.4.2 — Automated security scanning tools PO.3.1, PO.3.2 P.4.3 — Automated vulnerability detection RV.1.2 P.4.4 — Executable security testing PW.8.1, PW.8.2 P.4.5 — Regular third-party compliance PW.4.4

E.1 Safeguard artifact integrity

E.1.1 — Safely store release artifacts PS.3.1 E.1.2 — Version control PS.1.1, PS.1.2, PS.1.3

E.2 Safeguard build integrity

E.2.3 — Defensive compilation and build PW.6.1 E.2.4 — CI/CD hosting and automation PW.6.2

E.3 Secure software development environment

E.3.2 — Environmental separation PO.5.1

D.1 Respond to/disclose vulnerabilities

D.1.1 — Vulnerability analysis RV.2.1 D.1.2 — Risk-based vulnerability remediation RV.2.2 D.1.3 — Vulnerability disclosure RV.1.3 D.1.4 — Vulnerability eradication RV.3.3 D.1.6 — Root cause analysis RV.3.1

D.2 Monitor intrusions/violations

D.2.1 — System monitoring PO.5.3

G.1 Perform compliance

G.1.1 — Organizational security requirements 2 G.1.3 — Produce attestation 1f G.1.4 — Deliver provenance 3 G.1.5 — Deliver SBOM 3

G.2 Develop security policies

G.2.2 — Secure SDLC checks 4 G.2.4 — Security code review policy 2, 4

G.3 Manage suppliers

G.3.1 — Security-related contract terms 3

G.4 Training

G.4.3 — Gather attack trends 2

G.5 Assess and manage risk

G.5.4 — Data-informed product decisions 4

P.2 Build security in

P.2.1 — Security design review 4 P.2.2 — Secure coding 4 P.2.3 — Secure-by-default implementation 4

P.3 Manage component and container choices

P.3.4 — Vetted third-party component and container repositories 2, 3

P.4 Discover vulnerabilities

P.4.1 — Security code review 4 P.4.2 — Automated security scanning tools 1f, 2, 3 P.4.3 — Automated vulnerability detection 3, 4 P.4.4 — Executable security testing 2, 4 P.4.5 — Regular third-party compliance 2, 3, 4

E.2 Safeguard build integrity

E.2.3 — Defensive compilation and build 3 E.2.4 — CI/CD hosting and automation 4

E.3 Secure software development environment

E.3.2 — Environmental separation 1a, 1b, 1c, 1d, 1e, 1f, 2, 3

G.1 Perform compliance

G.1.3 — Produce attestation Producing artifacts G.1.4 — Deliver provenance Distributing provenance, Source L3: Signed and auditable provenance G.1.5 — Deliver SBOM Source L3: Signed and auditable provenance

G.3 Manage suppliers

G.3.1 — Security-related contract terms Verifying artifacts

P.1 Develop security requirements

P.1.2 — Software release integrity Distributing provenance, Source L3: Signed and auditable provenance

P.3 Manage component and container choices

P.3.4 — Vetted third-party component and container repositories Verifying artifacts, Build L1: Provenance exists

P.4 Discover vulnerabilities

P.4.1 — Security code review Source L4: Two-party review

E.1 Safeguard artifact integrity

E.1.1 — Safely store release artifacts Source L3: Signed and auditable provenance E.1.2 — Version control Source L1:  Version controlled E.1.5 — Branch protection Source L2: Controls

E.2 Safeguard build integrity

E.2.1 — Release policy verification Build L2: Hosted build platform E.2.2 — Verify dependencies and environment Verifying artifacts E.2.3 — Defensive compilation and build Verifying build platforms E.2.4 — CI/CD hosting and automation Build L2: Hosted build platform, Source L3: Signed and auditable provenance E.2.5 — Secured orchestration platform Build L3: Hardened builds E.2.8 — Hardened and isolated builds Build L3: Hardened builds

G.1 Perform compliance

G.1.1 — Organizational security requirements CP1.1, CP1.2, CP1.3, SE3.9, SR1.1, SR2.2, SR3.3 G.1.3 — Produce attestation SE3.9, SM1.4, SR1.3 G.1.5 — Deliver SBOM SE3.6

G.2 Develop security policies

G.2.1 — Upper management support SM1.3, CP2.5 G.2.2 — Secure SDLC checks SM1.4, SM3.3 G.2.3 — Roles and responsibilities SM2.3, SM2.7, CR1.7 G.2.4 — Security code review policy CR1.4, CR1.5 G.2.5 — Asset inventory CMVM2.3, SM3.1

G.3 Manage suppliers

G.3.1 — Security-related contract terms CP2.4, CP3.2, SR2.5, SR3.2

G.4 Training

G.4.1 — Role-based training T1.1, T1.7, T1.8, T2.5, T2.8, T2.9, T3.1, T3.2 G.4.2 — Contingency training T1.1 G.4.3 — Gather attack trends AM1.5, CMVM1.2

G.5 Assess and manage risk

G.5.1 — Criticality analysis AA1.4 G.5.2 — Track security risks and decisions SFD3.1, SM3.5 G.5.3 — Security metrics SM2.1, SM3.3 G.5.4 — Data-informed product decisions SM1.4, SM1.7

P.1 Develop security requirements

P.1.1 — Product security requirements CP1.1, CP1.2, CP1.3, CP2.1, SE2.5, SFD1.1, SFD2.1, SDF3.2, SR1.3 P.1.2 — Software release integrity SE2.4

P.2 Build security in

P.2.1 — Security design review AA1.1, AA1.2, AA2.1, AA3.1 P.2.2 — Secure coding SR3.3, CR1.4, CR3.5 P.2.3 — Secure-by-default implementation SE1.4 P.2.4 — Standard security features SFD1.1, SFD3.2 P.2.5 — In-house components SFD2.1

P.3 Manage component and container choices

P.3.1 — Component and container choice SR1.5 P.3.3 — Require signed commits SE2.4 P.3.4 — Vetted third-party component and container repositories SFD2.1, SFD3.2, SR2.4, SR2.7

P.4 Discover vulnerabilities

P.4.1 — Security code review CR1.2, CR1.4, CR2.8, CR2.6, CR2.7, CR3.4, CR3.5 P.4.2 — Automated security scanning tools CR1.4, SE.3.9, ST1.4, ST2.5 P.4.3 — Automated vulnerability detection CMVM3.1 P.4.4 — Executable security testing ST1.1, ST1.3, ST1.4, ST2.4, ST2.5, ST2.6, ST3.3, ST3.4, ST3.5, ST3.6, PT1.1, PT1.2, PT1.3, PT2.3, PT3.1, CMVM3.4

E.2 Safeguard build integrity

E.2.4 — CI/CD hosting and automation SE2.4, SE3.2 E.2.5 — Secured orchestration platform SE2.7

E.3 Secure software development environment

E.3.2 — Environmental separation SE3.10

D.1 Respond to/disclose vulnerabilities

D.1.1 — Vulnerability analysis CMVM1.3 D.1.3 — Vulnerability disclosure CMVM1.1, CMVM1.4, CMVM2.4 D.1.4 — Vulnerability eradication CR3.3, CMVM3.1 D.1.6 — Root cause analysis CP3.3, CMVM3.2

G.1 Perform compliance

G.1.1 — Organizational security requirements SC-CE: Establish and adhere to contribution policies G.1.2 — Software license conflict AU: Scan software for license implications, M-A: Managing software licenses G.1.3 — Produce attestation BP-SA Sign every step in the build process, A-A Use a store to manage metadata from in-toto G.1.4 — Deliver provenance A-A Distribute in-toto metadata with TUF, D-V Ensure clients can perform Verification of Artifacts and associated metadata, D-V Ensure clients can verify the freshness of files, D-A Use The Update Framework G.1.5 — Deliver SBOM M-V: Generate an immutable SBOM of code

G.2 Develop security policies

G.2.5 — Asset inventory M-V Require SBOMs and VEX statements from third-party suppliers, M-V Track dependencies between open source components

G.3 Manage suppliers

G.3.1 — Security-related contract terms M-V Require SBOMs and VEX statements from third-party suppliers

P.1 Develop security requirements

P.1.2 — Software release integrity A-V Validate the Signatures Generated at Each Step, A-A Use TUF to manage signing of artifacts

P.2 Build security in

P.2.5 — In-house components M-A Scan software for vulnerabilities

P.3 Manage component and container choices

P.3.1 — Component and container choice M: Second and third-party risk management P.3.2 — Trusted repositories M-V: Define trusted package managers, repositories, and libraries P.3.3 — Require signed commits BP-SA: Sign every step in the build process, SC-V Require verification attestations / confirmation P.3.4 — Vetted third-party component and container repositories A-CE Use a container registry that supports OCI image-spec images, M-V: Verify third party artifacts and open source libraries; SM, M-V Build libraries from source code, M-A Run software composition analysis on ingested software

P.4 Discover vulnerabilities

P.4.1 — Security code review C: Enforce independent 2-party review P.4.3 — Automated vulnerability detection SC-A: Prevent committing secrets to source code repository, SC-A: Automate software security scanning, M-A: Scan software for vulnerabilities, M-A Run software composition analysis on ingested software, A-V Perform additional checks on the artifact P.4.5 — Regular third-party compliance BP-SA Deploy monitoring tools to detect malicious behavior, D-A Continuous vulnerability scanning

P.5 Manage vulnerable components and containers

P.5.1 — SBOM consumption M-V: Require SBOMs and VEX statements from third-party suppliers, M-V Track dependencies between open source components

E.1 Safeguard artifact integrity

E.1.1 — Safely store release artifacts SC-V Authenticate and monitor repository activity E.1.2 — Version control SC-V Authenticate and monitor repository activity E.1.3 — Multi-factor authentication (MFA) SC-SA: Enforce MFA for accessing source code repositories E.1.4 — Developer SSH key SC-SA: Use SSH keys to provide developers access to upstream source code repositories E.1.5 — Branch protection SC-V Declare protected repository namespaces, SC-V Require verification attestations / confirmation, SC-CE Establish and adhere to contribution policies

E.2 Safeguard build integrity

E.2.1 — Release policy verification BP-V Enforcing policy, SC-V Require verification attestations / confirmation, A-V Policy E.2.2 — Verify dependencies and environment M-V: Verify third-party artifacts and open source artifacts, BP-V: Validate environments and dependencies before usage, D-V Admission controller/deployment gate E.2.4 — CI/CD hosting and automation BP-A: Build and related CI/CD should be automated, BP-A: Standardize pipeline across projects, BP-A: Build workers should be single-use, BP-CE: Ensure software factory had minimal network connectivity, BP-CE: Pass in build worker environment and commands, BP-SA: Only allow pipeline modifications through 'pipeline as code' E.2.5 — Secured orchestration platform BP-A: Provision a secured orchestration platform E.2.6 — Reproducible builds BP-V Validate build artifacts through verifiably reproducible builds, BP-V Recommendations for Reproducible Builds E.2.7 — Build output BP-CE: Write output to a separate secured storage repo E.2.8 — Hardened and isolated builds Build L3: Hardened builds, BP-A Build Workers Should be Single Use, BP-CE Ensure Build Pipeline has minimal network connectivit, BP-CE Segregate the Duties of Each Build Worker, BP-CE Pass in Build Worker Environment and Commands

E.3 Secure software development environment

E.3.2 — Environmental separation D-V Air-gapped deployment E.3.3 — Role-based access control A-CE Limit which artifacts any given party is authorized to certify, SC-CE Establish and adhere to contribution policies, SC-CE Define roles aligned to functional responsibilities, BP-SA Define user roles E.3.7 — Boundary protection BP-SA Deploy monitoring tools to detect malicious behavior E.3.8 — Key rotation A-CE Build in a system for rotating and revoking private keys, SC-SA: Have a key rotation policy E.3.9 — Ephemeral credentials SC-SA: Use short-lived/ephemeral credentials, BP-SA Use Short-Lived Workload Certificates E.3.10 — Establish a root of trust BP-SA: Follow best practices for establishing a root of trust from an offline source

D.2 Monitor intrusions/violations

D.2.1 — System monitoring BP-SA Deploy monitoring tools to detect malicious behavior, D-A Continuous vulnerability scanning D.2.2 — Build process monitoring BP-V Validate runtime security of build workers, SC-SA Use short-lived/ephemeral credentials for machine/service access, A-CE Use a container registry that supports OCI image-spec images

P.1 Develop security requirements

P.1.2 — Software release integrity signed-release, licenses

P.3 Manage component and container choices

P.3.1 — Component and container choice binary-artifacts, contributors, maintained

P.4 Discover vulnerabilities

P.4.1 — Security code review code-review P.4.2 — Automated security scanning tools sast, fuzzing P.4.4 — Executable security testing ci-tests

P.5 Manage vulnerable components and containers

P.5.2 — Dependency update dependency-update-tool

E.1 Safeguard artifact integrity

E.1.5 — Branch protection branch-protection

E.2 Safeguard build integrity

E.2.2 — Verify dependencies and environment pinned-dependencies E.2.4 — CI/CD hosting and automation dangerous-workflow, token-permissions, pinned-dependencies E.2.7 — Build output packaging

D.1 Respond to/disclose vulnerabilities

D.1.2 — Risk-based vulnerability remediation vulnerabilities D.1.3 — Vulnerability disclosure security-policy

G.1 Perform compliance

G.1.2 — Software license conflict 2.14, 2.15, 5.12 G.1.4 — Deliver provenance 6.1, 6.2, 6.3, 6.4 G.1.5 — Deliver SBOM 1.4, 2

G.2 Develop security policies

G.2.5 — Asset inventory 1

G.3 Manage suppliers

G.3.1 — Security-related contract terms 1.5

P.1 Develop security requirements

P.1.2 — Software release integrity 4.12, 6

P.2 Build security in

P.2.1 — Security design review 3.20, 3.21

P.3 Manage component and container choices

P.3.2 — Trusted repositories 1.2, 4.19 P.3.4 — Vetted third-party component and container repositories 5

P.4 Discover vulnerabilities

P.4.2 — Automated security scanning tools 5.1, 5.4 P.4.3 — Automated vulnerability detection 5.1, 5.2 P.4.5 — Regular third-party compliance 5, 5.8

P.5 Manage vulnerable components and containers

P.5.1 — SBOM consumption 5.4 P.5.2 — Dependency update 5.8

E.1 Safeguard artifact integrity

E.1.1 — Safely store release artifacts 6.3 E.1.2 — Version control 4.10 E.1.3 — Multi-factor authentication (MFA) 4.5 E.1.5 — Branch protection 4.17 E.1.6 — Decommission assets 5.8

E.2 Safeguard build integrity

E.2.2 — Verify dependencies and environment 1.10, 4.13, 4.19 E.2.3 — Defensive compilation and build 3 E.2.4 — CI/CD hosting and automation 2, 3 E.2.8 — Hardened and isolated builds 3