Markdown Editor
Abrir el editor

Kit de cadena de suministro de software segura

De NIST SSDF y OWASP SAMM a CI/CD, reglas de dependencias y propiedad del código, SBOM y VEX, divulgación de vulnerabilidades, PSIRT, avisos y obligaciones del EU CRA.

Paso 1

Estrategia

  1. SSDF Self-Assessment and Attestation Template (NIST SP 800-218)

    Completa

    SSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation

    NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A

  2. OWASP SAMM Assessment Template

    Completa

    OWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics

    OWASP SAMM v2 (core v2.2.0)
Paso 2

Seguridad

  1. Secure Coding Standard Template

    Estándar

    Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process

  2. Threat Model Template (STRIDE)

    Completa

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE
Paso 3

Construcción

  1. CI/CD Pipeline Design Template (SLSA, NIST SP 800-204D)

    Completa

    CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability

    NIST SP 800-204D; NIST SP 800-218 SSDF 1.1; SLSA 1.2; OWASP Top 10 CI/CD Security Risks

  2. Branching Strategy Template (Trunk-Based, SLSA Source)

    Completa

    Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics

    SLSA 1.2 Source track; DORA trunk-based development; Conventional Commits 1.0.0

  3. Code Ownership Policy Template (CODEOWNERS)

    Completa

    Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

    GitHub and GitLab code owners documentation; SLSA 1.2 Source track

  4. Dependency Management Policy Template (SSDF, Scorecard)

    Completa

    Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics

    NIST SP 800-218 SSDF 1.1 PW.4; OpenSSF Scorecard v5; OSPS Baseline v2026.08.28
Paso 4

Cadena de suministro y SBOM

  1. Software Supply Chain Security Assessment Template (SLSA)

    Completa

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. SBOM and VEX Policy Template (CISA 2026, CycloneDX, SPDX)

    Completa

    SBOM production, signing, VEX rules, distribution, supplier SBOMs, retention, exceptions, metrics, CISA 2026 to CycloneDX and SPDX field map

    CISA 2026 SBOM Minimum Elements; CycloneDX 1.7; SPDX 3.0.1; CISA VEX

  3. AI Bill of Materials Template (CycloneDX ML-BOM, SPDX AI)

    Completa

    AI-BOM: models, datasets, software, agents, tools, prompts, training config, lineage, risk and VEX, CycloneDX 1.7 and SPDX 3.0.1 mapping, G7 crosswalk

    CycloneDX 1.7 (ECMA-424); SPDX 3.0.1; G7 SBOM for AI Minimum Elements (2026)
Paso 5

Entrega y transición

  1. Software Release Checklist Template (Staged Rollout, SBOM, VEX)

    Completa

    Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs

    CISA Safe Software Deployment (2024); CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1
Paso 6

Divulgación y avisos

  1. Vulnerability Disclosure Policy Template (ISO/IEC 29147, security.txt)

    Completa

    Public CVD policy: scope, safe harbour, reporting channels, response timelines, embargo, CVE and advisories, credit, CRA notes, ready RFC 9116 security.txt

    ISO/IEC 29147:2018 (structure); RFC 9116; EU CRA Art. 13, 14

  2. PSIRT Vulnerability Handling Procedure Template (ISO/IEC 30111, CVSS v4)

    Completa

    Producer-side PSIRT procedure: intake, verification, CVSS v4.0, EPSS, KEV and SSVC triage, remediation targets, advisory and VEX, CVE/CNA, CRA Art. 14, metrics

    ISO/IEC 30111:2019 (structure); CVSS v4.0; CISA SSVC; CNA Rules 4.2.0; EU CRA Art. 14

  3. Security Advisory Template (CSAF 2.0, VEX)

    Completa

    CSAF-aligned advisory: metadata, product tree, vulnerabilities, product status, VEX statement, remediations, CVSS v4.0, timeline, checklist

    OASIS CSAF 2.0; CISA VEX minimum requirements; CVSS v4.0

  4. CRA Vulnerability Handling and Reporting Procedure Template

    Completa

    EU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline

    Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP

  5. SECURITY.md Security Policy Template

    Completa

    SECURITY.md: supported versions, private reporting channels, response targets, embargo, safe harbour, CVE and advisories, security.txt, CRA note

    ISO/IEC 29147:2018 (structure); RFC 9116; CRA Art. 14