PO.3 Implement Supporting Toolchains

Statement

Specify which tools or tool types must or should be included in each toolchain to mitigate identified risks, as well as how the toolchain components are to be integrated with each other.

Example 1:

Define categories of toolchains, and specify the mandatory tools or tool types to be used for each category.

Example 2:

Identify security tools to integrate into the developer toolchain.

Example 3:

Define what information is to be passed between tools and what data formats are to be used.

Example 4:

Evaluate tools’ signing capabilities to create immutable records/logs for auditability within the toolchain.

Example 5:

Use automated technology for toolchain management and orchestration.

Statement

Follow recommended security practices to deploy, operate, and maintain tools and toolchains.

Example 1:

Evaluate, select, and acquire tools, and assess the security of each tool.

Example 2:

Integrate tools with other tools and existing software development processes and workflows.

Example 3:

Use code-based configuration for toolchains (e.g., pipelines-as-code, toolchains-as-code).

Example 4:

Implement the technologies and processes needed for reproducible builds.

Example 5:

Update, upgrade, or replace tools as needed to address tool vulnerabilities or add new tool capabilities.

Example 6:

Continuously monitor tools and tool logs for potential operational and security issues, including policy violations and anomalous behavior.

Example 7:

Regularly verify the integrity and check the provenance of each tool to identify potential problems.

Example 8:

See PW.6 regarding compiler, interpreter, and build tools.

Example 9:

See PO.5 regarding implementing and maintaining secure environments.

Statement

Configure tools to generate artifacts of their support of secure software development practices as defined by the organization.

Example 1:

Use existing tooling (e.g., workflow tracking, issue tracking, value stream mapping) to create an audit trail of the secure development-related actions that are performed for continuous improvement purposes.

Example 2:

Determine how often the collected information should be audited, and implement the necessary processes.

Example 3:

Establish and enforce security and retention policies for artifact data.

Example 4:

Assign responsibility for creating any needed artifacts that tools cannot generate.