Markdown Editor
エディターを開く

セキュアソフトウェアサプライチェーンキット

NIST SSDFとOWASP SAMMから、CI/CD、依存関係とコードオーナーシップのルール、SBOMとVEX、脆弱性開示、PSIRT、アドバイザリ、EU CRAの義務まで。

ステップ 1

戦略

  1. SSDF Self-Assessment and Attestation Template (NIST SP 800-218)

    フル

    SSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation

    NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A

  2. OWASP SAMM Assessment Template

    フル

    OWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics

    OWASP SAMM v2 (core v2.2.0)
ステップ 2

セキュリティ

  1. Secure Coding Standard Template

    標準

    Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process

  2. Threat Model Template (STRIDE)

    フル

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE
ステップ 3

構築

  1. CI/CD Pipeline Design Template (SLSA, NIST SP 800-204D)

    フル

    CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability

    NIST SP 800-204D; NIST SP 800-218 SSDF 1.1; SLSA 1.2; OWASP Top 10 CI/CD Security Risks

  2. Branching Strategy Template (Trunk-Based, SLSA Source)

    フル

    Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics

    SLSA 1.2 Source track; DORA trunk-based development; Conventional Commits 1.0.0

  3. Code Ownership Policy Template (CODEOWNERS)

    フル

    Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

    GitHub and GitLab code owners documentation; SLSA 1.2 Source track

  4. Dependency Management Policy Template (SSDF, Scorecard)

    フル

    Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics

    NIST SP 800-218 SSDF 1.1 PW.4; OpenSSF Scorecard v5; OSPS Baseline v2026.08.28
ステップ 4

サプライチェーンとSBOM

  1. Software Supply Chain Security Assessment Template (SLSA)

    フル

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. SBOM and VEX Policy Template (CISA 2026, CycloneDX, SPDX)

    フル

    SBOM production, signing, VEX rules, distribution, supplier SBOMs, retention, exceptions, metrics, CISA 2026 to CycloneDX and SPDX field map

    CISA 2026 SBOM Minimum Elements; CycloneDX 1.7; SPDX 3.0.1; CISA VEX

  3. AI Bill of Materials Template (CycloneDX ML-BOM, SPDX AI)

    フル

    AI-BOM: models, datasets, software, agents, tools, prompts, training config, lineage, risk and VEX, CycloneDX 1.7 and SPDX 3.0.1 mapping, G7 crosswalk

    CycloneDX 1.7 (ECMA-424); SPDX 3.0.1; G7 SBOM for AI Minimum Elements (2026)
ステップ 5

リリースと移行

  1. Software Release Checklist Template (Staged Rollout, SBOM, VEX)

    フル

    Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs

    CISA Safe Software Deployment (2024); CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1
ステップ 6

脆弱性開示とアドバイザリ

  1. Vulnerability Disclosure Policy Template (ISO/IEC 29147, security.txt)

    フル

    Public CVD policy: scope, safe harbour, reporting channels, response timelines, embargo, CVE and advisories, credit, CRA notes, ready RFC 9116 security.txt

    ISO/IEC 29147:2018 (structure); RFC 9116; EU CRA Art. 13, 14

  2. PSIRT Vulnerability Handling Procedure Template (ISO/IEC 30111, CVSS v4)

    フル

    Producer-side PSIRT procedure: intake, verification, CVSS v4.0, EPSS, KEV and SSVC triage, remediation targets, advisory and VEX, CVE/CNA, CRA Art. 14, metrics

    ISO/IEC 30111:2019 (structure); CVSS v4.0; CISA SSVC; CNA Rules 4.2.0; EU CRA Art. 14

  3. Security Advisory Template (CSAF 2.0, VEX)

    フル

    CSAF-aligned advisory: metadata, product tree, vulnerabilities, product status, VEX statement, remediations, CVSS v4.0, timeline, checklist

    OASIS CSAF 2.0; CISA VEX minimum requirements; CVSS v4.0

  4. CRA Vulnerability Handling and Reporting Procedure Template

    フル

    EU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline

    Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP

  5. SECURITY.md Security Policy Template

    フル

    SECURITY.md: supported versions, private reporting channels, response targets, embargo, safe harbour, CVE and advisories, security.txt, CRA note

    ISO/IEC 29147:2018 (structure); RFC 9116; CRA Art. 14