Create new roles and alter responsibilities for existing roles as needed to encompass all parts of the SDLC.Periodically review and maintain the defined roles and responsibilities, updating them as needed.

Designate a group of individuals as the code owners for each project, and review the list annually.

Specify which tools or tool types must or should be included in each toolchain to mitigate identified risks, as well as how the toolchain components are to be integrated with each other.

Use software factories and/or software templates to standardize the toolchain.

Can scaffold projects with pipelines-as-code and toolchains-as-code

Implements the In-toto framework using pipelines-as-code

CDEvents is a common specification for Continuous Delivery events, enabling interoperability in the complete software production ecosystem.

Follow recommended security practices to deploy, operate, and maintain tools and toolchains.

Use code-based configuration for toolchains (e.g., pipelines-as-code, toolchains-as-code).

Follow recommended security practices to deploy, operate, and maintain tools and toolchains.

Implement the technologies and processes needed for reproducible builds.

• pylock.toml

  (preferred, newest standard)

• uv

  (uses pylock.toml)

• conda

  (reproducible but less standard than pylock-toml)

• pip freeze to requirements.txt

  (not fully reproducible)

• npm package-lock.json

  created in the coding phase, combined with npm ci in the build phase

• yarn yarn.lock

• Maven
• Gradle

• NuGet lockfiles
• DotNet.ReproducibleBuilds

• Bazel

• Cargo

• Golang

Configure tools to generate artifacts of their support of secure software development practices as defined by the organization.

Use existing tooling (e.g., workflow tracking, issue tracking, value stream mapping) to create an audit trail of the secure development-related actions that are performed for continuous improvement purposes. Record security check approvals, rejections, and exception requests as part of the workflow and tracking system.

Define criteria for software security checks and track throughout the SDLC.

Add software security criteria to existing checks (e.g., the Definition of Done in agile SDLC methodologies).

Implement processes, mechanisms, etc. to gather and safeguard the necessary information in support of the criteria.

Collect audit logs for code repositories.

• Audit Logs

Implement processes, mechanisms, etc. to gather and safeguard the necessary information in support of the criteria.

Only allow authorized personnel to access the gathered information, and prevent any alteration or deletion of the information. Carefully manage the list of repository owners and organization owners who have the ability to view audit logs, delete organizations, and delete code repositories, and review the list annually.

• Roles in an Organization
• Github Repository Roles

• Roles and Permissions

Separate and protect each environment involved in software development.

Require multifactor authentication, SSH keys, signed commits, and code change approvals for code repositories at the organization level.

• requiring multifactor authentication
• requiring signed commits
• requiring code change approvals and protecting the main branch

• requiring multifactor authentication
• requiring signed commits via push rules
• requiring code change approvals by protecting the main branch