G.1 Perform compliance

Compliance is following established guidelines or specifications, possibly demonstrated through an audit.

Controls

G.1.1 Organizational security requirements

Organizational security requirements, such as those imposed by standards and regulations, are included in the SDLC.

G.1.2 Software license conflict

Software licenses that conflict with the organization's policies are identified.

G.1.3 Produce attestation

Produce an audit trail for every step in the build process, the integrity/provenance of training data, and evidence of the use of secure software development practices.

G.1.4 Deliver provenance

Enable traceability and reproducibility of the actions performed while writing code, compiling, testing, and deploying software by making transparent the steps that were performed, by whom and in what order.

G.1.5 Deliver SBOM

By providing SBOM, enable internal and external customers to analyze the contents of the final software package, including the version of the dependencies.