PS.3 Archive and Protect Each Software Release

Statement

Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release.

Example 1:

Store the release files, associated images, etc. in repositories following the organization’s established policy. Allow read-only access to them by necessary personnel and no access by anyone else.

Example 2:

Store and protect release integrity verification information and provenance data, such as by keeping it in a separate location from the release files or by signing the data.

Statement

Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials .SBOM).

Example 1:

Make the provenance data available to software acquirers in accordance with the organization’s policies, preferably using standards-based formats.

Example 2:

Make the provenance data available to the organization’s operations and response teams to aid them in mitigating software vulnerabilities.

Example 3:

Protect the integrity of provenance data, and provide a way for recipients to verify provenance data integrity.

Example 4:

Update the provenance data every time any of the software’s components are updated.