NIST SSDF (Secure Software Development Framework)

• · PO1 — Security requirements for the organization's software are defined and communicated, reviewed/updated periodically.
• · PO2 — Roles and responsibilities for secure development are defined (who threat-models, who reviews, who owns dependency updates).
• · PO3 — Toolchains (SAST, dependency scanning, secrets scanning) are selected, configured, and integrated into the development process, not left optional/ad hoc.
• · PS1 — Source code and build artifacts are protected from unauthorized access (repository permissions, branch protection, signed commits where warranted).
• · PS2 — Provenance of all software components (including third-party/open-source) is tracked — an SBOM or equivalent exists and is kept current.

• · The "who's responsible" test: ask who owns dependency updates, who does security review, who responds to a vulnerability report — if the honest answer is "nobody specifically," PO2/RV1 gaps exist.
• · The build-tampering test: could someone with write access to CI configuration (but not the main codebase) inject arbitrary code into a release build unnoticed? (PS3)
• · The disclosure-channel test: if an external researcher found a vulnerability today, is there a published way for them to report it responsibly (security.txt, a security@ email, a bug bounty)? (RV1)
• · The "threat model before code" check: for the last few sensitive features shipped, was a threat model or security requirement documented before implementation, or only a post-hoc review after the fact? (PW1)
• · The dependency-vetting check: before adding a new third-party package, is there any check beyond "does it work" (maintenance status, known vulnerabilities, license)? (PW3)

• · Ver anti-patrones específicos del dominio en el pack.

• [ ] Named owner exists for dependency updates, security review, and vulnerability response. (NS2)
• [ ] Dependency and secrets scanning integrated into CI on every merge. (NS3)
• [ ] Repository/CI configuration changes require review; release commits traceable to authenticated identity. (NS4)
• [ ] Sensitive features have a documented threat model/security requirement written before implementation. (NS7)
• [ ] Authentication/authorization/data-handling changes receive explicit security-focused review. (NS9)
• [ ] Published vulnerability disclosure channel exists and is monitored. (NS10)

• Secure Software Development Framework (SSDF) Version 1.1 — NIST SP 800-218

Este pack cita las siguientes fuentes registradas en el índice bibliográfico:

• specSecure Software Development Framework (SSDF) Version 1.1 — NIST SP 800-218National Institute of Standards and Technology