U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

White Paper (Draft)

[Project Description] Software Supply Chain and DevOps Security Practices: Implementing a Risk-Based Approach to DevSecOps

Date Published: July 21, 2022
Comments Due: August 22, 2022
Email Comments to: devsecops-nist@nist.gov

Author(s)

Karen Scarfone (Scarfone Cybersecurity), Murugiah Souppaya (NIST)

Announcement

The NCCoE has released this draft Project Description, which begins a process to solicit public comments for the project requirements, scope, and hardware and software components for use in a laboratory environment.

The project will focus initially on developing and documenting an applied risk-based approach and recommendations for secure DevOps and software supply chain practices consistent with the Secure Software Development Framework (SSDF), Cybersecurity Supply Chain Risk Management (C-SCRM), and other NIST, government, and industry guidance. This project will apply these practices in proof-of-concept use case scenarios that are each specific to a technology, programming language, and industry sector. Both commercial and open source technology will be used to demonstrate the use cases. This project will result in a freely available NIST Cybersecurity Practice Guide. 

Review the project description and submit comments online on or before August 22, 2022. You can also help shape and contribute to this project by joining the NCCoE’s DevSecOps Community of Interest. Send an email to devsecops-nist@nist.gov detailing your interest. 

We value and welcome your input and look forward to your comments. 
 
 

Abstract

Keywords

cloud-native technology; cybersecurity supply chain risk management; DevOps; DevSecOps; secure software development; Secure Software Development Framework (SSDF); supply chain security
Control Families

Assessment, Authorization and Monitoring; System and Communications Protection; System and Information Integrity; System and Services Acquisition

Documentation

Publication:
Draft Project Description

Supplemental Material:
Project homepage (web)

Document History:
07/21/22: White Paper (Draft)