Markdown Editor
Buka editor

Kit rantai pasok perangkat lunak yang aman

Dari NIST SSDF dan OWASP SAMM hingga CI/CD, aturan dependensi dan kepemilikan kode, SBOM dan VEX, pengungkapan kerentanan, PSIRT, advisori, serta kewajiban EU CRA.

Langkah 1

Strategi

  1. SSDF Self-Assessment and Attestation Template (NIST SP 800-218)

    Lengkap

    SSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation

    NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A

  2. OWASP SAMM Assessment Template

    Lengkap

    OWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics

    OWASP SAMM v2 (core v2.2.0)
Langkah 2

Keamanan

  1. Secure Coding Standard Template

    Standar

    Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process

  2. Threat Model Template (STRIDE)

    Lengkap

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE
Langkah 3

Pembangunan

  1. CI/CD Pipeline Design Template (SLSA, NIST SP 800-204D)

    Lengkap

    CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability

    NIST SP 800-204D; NIST SP 800-218 SSDF 1.1; SLSA 1.2; OWASP Top 10 CI/CD Security Risks

  2. Branching Strategy Template (Trunk-Based, SLSA Source)

    Lengkap

    Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics

    SLSA 1.2 Source track; DORA trunk-based development; Conventional Commits 1.0.0

  3. Code Ownership Policy Template (CODEOWNERS)

    Lengkap

    Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

    GitHub and GitLab code owners documentation; SLSA 1.2 Source track

  4. Dependency Management Policy Template (SSDF, Scorecard)

    Lengkap

    Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics

    NIST SP 800-218 SSDF 1.1 PW.4; OpenSSF Scorecard v5; OSPS Baseline v2026.08.28
Langkah 4

Rantai pasok dan SBOM

  1. Software Supply Chain Security Assessment Template (SLSA)

    Lengkap

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. SBOM and VEX Policy Template (CISA 2026, CycloneDX, SPDX)

    Lengkap

    SBOM production, signing, VEX rules, distribution, supplier SBOMs, retention, exceptions, metrics, CISA 2026 to CycloneDX and SPDX field map

    CISA 2026 SBOM Minimum Elements; CycloneDX 1.7; SPDX 3.0.1; CISA VEX

  3. AI Bill of Materials Template (CycloneDX ML-BOM, SPDX AI)

    Lengkap

    AI-BOM: models, datasets, software, agents, tools, prompts, training config, lineage, risk and VEX, CycloneDX 1.7 and SPDX 3.0.1 mapping, G7 crosswalk

    CycloneDX 1.7 (ECMA-424); SPDX 3.0.1; G7 SBOM for AI Minimum Elements (2026)
Langkah 5

Rilis dan transisi

  1. Software Release Checklist Template (Staged Rollout, SBOM, VEX)

    Lengkap

    Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs

    CISA Safe Software Deployment (2024); CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1
Langkah 6

Pengungkapan dan advisori

  1. Vulnerability Disclosure Policy Template (ISO/IEC 29147, security.txt)

    Lengkap

    Public CVD policy: scope, safe harbour, reporting channels, response timelines, embargo, CVE and advisories, credit, CRA notes, ready RFC 9116 security.txt

    ISO/IEC 29147:2018 (structure); RFC 9116; EU CRA Art. 13, 14

  2. PSIRT Vulnerability Handling Procedure Template (ISO/IEC 30111, CVSS v4)

    Lengkap

    Producer-side PSIRT procedure: intake, verification, CVSS v4.0, EPSS, KEV and SSVC triage, remediation targets, advisory and VEX, CVE/CNA, CRA Art. 14, metrics

    ISO/IEC 30111:2019 (structure); CVSS v4.0; CISA SSVC; CNA Rules 4.2.0; EU CRA Art. 14

  3. Security Advisory Template (CSAF 2.0, VEX)

    Lengkap

    CSAF-aligned advisory: metadata, product tree, vulnerabilities, product status, VEX statement, remediations, CVSS v4.0, timeline, checklist

    OASIS CSAF 2.0; CISA VEX minimum requirements; CVSS v4.0

  4. CRA Vulnerability Handling and Reporting Procedure Template

    Lengkap

    EU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline

    Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP

  5. SECURITY.md Security Policy Template

    Lengkap

    SECURITY.md: supported versions, private reporting channels, response targets, embargo, safe harbour, CVE and advisories, security.txt, CRA note

    ISO/IEC 29147:2018 (structure); RFC 9116; CRA Art. 14