Markdown Editor
Open the editor

Secure Software Supply Chain Kit

From NIST SSDF and OWASP SAMM to CI/CD, dependency and code ownership rules, SBOM and VEX, vulnerability disclosure, PSIRT, advisories and EU CRA duties.

Step 1

Strategy

  1. SSDF Self-Assessment and Attestation Template (NIST SP 800-218)

    Full

    SSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation

    NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A

  2. OWASP SAMM Assessment Template

    Full

    OWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics

    OWASP SAMM v2 (core v2.2.0)
Step 2

Security

  1. Secure Coding Standard Template

    Standard

    Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process

  2. Threat Model Template (STRIDE)

    Full

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE
Step 3

Build

  1. CI/CD Pipeline Design Template (SLSA, NIST SP 800-204D)

    Full

    CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability

    NIST SP 800-204D; NIST SP 800-218 SSDF 1.1; SLSA 1.2; OWASP Top 10 CI/CD Security Risks

  2. Branching Strategy Template (Trunk-Based, SLSA Source)

    Full

    Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics

    SLSA 1.2 Source track; DORA trunk-based development; Conventional Commits 1.0.0

  3. Code Ownership Policy Template (CODEOWNERS)

    Full

    Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

    GitHub and GitLab code owners documentation; SLSA 1.2 Source track

  4. Dependency Management Policy Template (SSDF, Scorecard)

    Full

    Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics

    NIST SP 800-218 SSDF 1.1 PW.4; OpenSSF Scorecard v5; OSPS Baseline v2026.08.28
Step 4

Supply chain and SBOM

  1. Software Supply Chain Security Assessment Template (SLSA)

    Full

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. SBOM and VEX Policy Template (CISA 2026, CycloneDX, SPDX)

    Full

    SBOM production, signing, VEX rules, distribution, supplier SBOMs, retention, exceptions, metrics, CISA 2026 to CycloneDX and SPDX field map

    CISA 2026 SBOM Minimum Elements; CycloneDX 1.7; SPDX 3.0.1; CISA VEX

  3. AI Bill of Materials Template (CycloneDX ML-BOM, SPDX AI)

    Full

    AI-BOM: models, datasets, software, agents, tools, prompts, training config, lineage, risk and VEX, CycloneDX 1.7 and SPDX 3.0.1 mapping, G7 crosswalk

    CycloneDX 1.7 (ECMA-424); SPDX 3.0.1; G7 SBOM for AI Minimum Elements (2026)
Step 5

Release and transition

  1. Software Release Checklist Template (Staged Rollout, SBOM, VEX)

    Full

    Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs

    CISA Safe Software Deployment (2024); CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1
Step 6

Disclosure and advisories

  1. Vulnerability Disclosure Policy Template (ISO/IEC 29147, security.txt)

    Full

    Public CVD policy: scope, safe harbour, reporting channels, response timelines, embargo, CVE and advisories, credit, CRA notes, ready RFC 9116 security.txt

    ISO/IEC 29147:2018 (structure); RFC 9116; EU CRA Art. 13, 14

  2. PSIRT Vulnerability Handling Procedure Template (ISO/IEC 30111, CVSS v4)

    Full

    Producer-side PSIRT procedure: intake, verification, CVSS v4.0, EPSS, KEV and SSVC triage, remediation targets, advisory and VEX, CVE/CNA, CRA Art. 14, metrics

    ISO/IEC 30111:2019 (structure); CVSS v4.0; CISA SSVC; CNA Rules 4.2.0; EU CRA Art. 14

  3. Security Advisory Template (CSAF 2.0, VEX)

    Full

    CSAF-aligned advisory: metadata, product tree, vulnerabilities, product status, VEX statement, remediations, CVSS v4.0, timeline, checklist

    OASIS CSAF 2.0; CISA VEX minimum requirements; CVSS v4.0

  4. CRA Vulnerability Handling and Reporting Procedure Template

    Full

    EU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline

    Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP

  5. SECURITY.md Security Policy Template

    Full

    SECURITY.md: supported versions, private reporting channels, response targets, embargo, safe harbour, CVE and advisories, security.txt, CRA note

    ISO/IEC 29147:2018 (structure); RFC 9116; CRA Art. 14