+4.2 General Security Recommendations

4.2 General Security Recommendations

Security controls should be applied end-to-end across the SBOM CI/CD pipeline to protect the main principles of confidentiality, integrity, availability, authenticity and non-repudiation. Table 7 presents indicative security controls to be taken into consideration when building the CI/CD pipelines and their purpose.

	Lifecycle Phase		Security control	Purpose
All Phases		Role-based Access Control (RBAC)		Restrict access to repositories, CI/CD

workflows, signing service and SBOM

repositories based on least privilege.

Multi-factor Authentication (MFA)	Protect developer, administrator and CI/CD platform accounts from credential compromise.
Least Privilege		Minimize permissions to users, service

accounts and automation.

Secure Transport Layer	Protect communications between pipeline components using TLS 1.3 with certificate validation.
Audit Logging		Record all pipeline activities, including

generation, validation, signing events etc.

	Security Event Alerting	Generate alerts for failed validations, signature failures and unauthorized access.
	Pipeline Integrity Protection	Protect CI/CD workflows from unauthorized modification through code review and branch protection.
	Configuration Management	Maintain version-controlled and approved configurations for pipeline components and security policies.
	Tool stack verification	Verify the integrity and provenance of SBOM generators, validators and supporting tools before execution.
Generation	Trusted repositories	Retrieve dependencies only from authenticated and trusted registries or mirrors.

		Provenance Generation		Generate verifiable build provenance linking source, build process, SBOM and software artifact.
	Validation, Signing,		Secure Secrets		Store signing keys, API tokens and repository
	Store		Management		credentials in secure vaults where applicable.
Signing, Store		Artifact Binding			Cryptographically associate the SBOM with

the software artifact it describes.

Store	Tamper-Evident Storage		Store SBOMs and artifacts in immutable or version-controlled repositories with integrity protection.
		Repository Integrity		Detect unauthorized changes to source code,
		Monitoring		artifacts or SBOM repositories.
Store, Maintenance & Update	Version control			Maintain version history of software artifacts

and associated SBOMs.

Backup and Recovery

Ensure SBOM repositories, signing material

and audit logs can be recovered.

Table 7 - Security Recommendations

1. Apžvalga

Pavadinimas	Standartas

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai
Šaltinis	Reikalavimas

3. Susiję teisės aktai

Teisės aktai
Šaltinis	Reguliavimas

ENISA -