Implementation of SDLC Supporting Toolchains, v1.1
Specifies requirements in accordance with NIST Secure Software Development Framework (SSDF), version 1.1, Practice PO.3: Implementation of SDLC Supporting Toolchains. Requires an organization to use automation to reduce human effort and improve the accuracy, reproducibility, usability, and comprehensiveness of security practices throughout the SDLC, as well as provide a way to document and demonstrate the use of these practices. Toolchains and tools may be used at different levels of the organization, such as organization-wide or project-specific, and may address a particular part of the SDLC, like a build pipeline.
Assessment Steps (3)
|
1
SDLC Toolchain Composition and Integration (SDLCToolchainCompositionandIntegration)
Does the organization specify which tools or tool types must or should be included in each toolchain to mitigate identified risks, as well as how the toolchain components are to be integrated with each other?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
|
|
2
SDLC Toolchain Use (SDLCToolchainUse)
Does the organization follow recommended security practices to deploy, operate, and maintain tools and toolchains?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
|
|
3
Tool-Generated SDLC Security Artifacts (Tool-GeneratedSDLCSecurityArtifacts)
Does the organization configure tools to generate artifacts of their support of secure software development practices as defined by the organization?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
|
Conformance Criteria (3)
|
SDLC Toolchain Composition and Integration
The organization must specify which tools or tool types must or should be included in each toolchain to mitigate identified risks, as well as how the toolchain components are to be integrated with each other.
Citation
SSDF
Task PO.3.1
|
|
SDLC Toolchain Use
The organization must follow recommended security practices to deploy, operate, and maintain tools and toolchains.
Citation
SSDF
Task PO.3.2
|
|
Tool-Generated SDLC Security Artifacts
The organization must configure tools to generate artifacts of their support of secure software development practices as defined by the organization.
Citation
SSDF
Task PO.3.3
|