Markdown Editor
Editor öffnen

Kit sichere Software-Lieferkette

Von NIST SSDF und OWASP SAMM bis CI/CD, Regeln für Abhängigkeiten und Code-Ownership, SBOM und VEX, Schwachstellenoffenlegung, PSIRT, Advisories und Pflichten aus dem EU CRA.

Schritt 1

Strategie

  1. SSDF Self-Assessment and Attestation Template (NIST SP 800-218)

    Vollständig

    SSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation

    NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A

  2. OWASP SAMM Assessment Template

    Vollständig

    OWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics

    OWASP SAMM v2 (core v2.2.0)
Schritt 2

Sicherheit

  1. Secure Coding Standard Template

    Standard

    Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process

  2. Threat Model Template (STRIDE)

    Vollständig

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE
Schritt 3

Umsetzung

  1. CI/CD Pipeline Design Template (SLSA, NIST SP 800-204D)

    Vollständig

    CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability

    NIST SP 800-204D; NIST SP 800-218 SSDF 1.1; SLSA 1.2; OWASP Top 10 CI/CD Security Risks

  2. Branching Strategy Template (Trunk-Based, SLSA Source)

    Vollständig

    Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics

    SLSA 1.2 Source track; DORA trunk-based development; Conventional Commits 1.0.0

  3. Code Ownership Policy Template (CODEOWNERS)

    Vollständig

    Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

    GitHub and GitLab code owners documentation; SLSA 1.2 Source track

  4. Dependency Management Policy Template (SSDF, Scorecard)

    Vollständig

    Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics

    NIST SP 800-218 SSDF 1.1 PW.4; OpenSSF Scorecard v5; OSPS Baseline v2026.08.28
Schritt 4

Lieferkette und SBOM

  1. Software Supply Chain Security Assessment Template (SLSA)

    Vollständig

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. SBOM and VEX Policy Template (CISA 2026, CycloneDX, SPDX)

    Vollständig

    SBOM production, signing, VEX rules, distribution, supplier SBOMs, retention, exceptions, metrics, CISA 2026 to CycloneDX and SPDX field map

    CISA 2026 SBOM Minimum Elements; CycloneDX 1.7; SPDX 3.0.1; CISA VEX

  3. AI Bill of Materials Template (CycloneDX ML-BOM, SPDX AI)

    Vollständig

    AI-BOM: models, datasets, software, agents, tools, prompts, training config, lineage, risk and VEX, CycloneDX 1.7 and SPDX 3.0.1 mapping, G7 crosswalk

    CycloneDX 1.7 (ECMA-424); SPDX 3.0.1; G7 SBOM for AI Minimum Elements (2026)
Schritt 5

Release und Übergabe

  1. Software Release Checklist Template (Staged Rollout, SBOM, VEX)

    Vollständig

    Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs

    CISA Safe Software Deployment (2024); CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1
Schritt 6

Offenlegung und Advisories

  1. Vulnerability Disclosure Policy Template (ISO/IEC 29147, security.txt)

    Vollständig

    Public CVD policy: scope, safe harbour, reporting channels, response timelines, embargo, CVE and advisories, credit, CRA notes, ready RFC 9116 security.txt

    ISO/IEC 29147:2018 (structure); RFC 9116; EU CRA Art. 13, 14

  2. PSIRT Vulnerability Handling Procedure Template (ISO/IEC 30111, CVSS v4)

    Vollständig

    Producer-side PSIRT procedure: intake, verification, CVSS v4.0, EPSS, KEV and SSVC triage, remediation targets, advisory and VEX, CVE/CNA, CRA Art. 14, metrics

    ISO/IEC 30111:2019 (structure); CVSS v4.0; CISA SSVC; CNA Rules 4.2.0; EU CRA Art. 14

  3. Security Advisory Template (CSAF 2.0, VEX)

    Vollständig

    CSAF-aligned advisory: metadata, product tree, vulnerabilities, product status, VEX statement, remediations, CVSS v4.0, timeline, checklist

    OASIS CSAF 2.0; CISA VEX minimum requirements; CVSS v4.0

  4. CRA Vulnerability Handling and Reporting Procedure Template

    Vollständig

    EU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline

    Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP

  5. SECURITY.md Security Policy Template

    Vollständig

    SECURITY.md: supported versions, private reporting channels, response targets, embargo, safe harbour, CVE and advisories, security.txt, CRA note

    ISO/IEC 29147:2018 (structure); RFC 9116; CRA Art. 14