@@ -46,8 +46,10 @@ dimension:
4646 - Quality is not visible to everyone, quality checks are distributed or
4747 manually and not deterministic.
4848 usefulness : 2
49+ isImplemented : true
4950 - dependsOn :
5051 - Continuous Integration
52+ isImplemented : false
5153 description : ' Sample evidence as an attribute in the yaml: The build process
5254 is defined in <a href="REPLACE-ME">REPLACE-ME Pipeline</a>
5355
@@ -92,6 +94,7 @@ dimension:
9294 knowledge : 2
9395 resources : 2
9496 time : 2
97+ isImplemented : true
9598 implementation :
9699 - name : CI/CD tools # string
97100 tags :
@@ -135,6 +138,7 @@ dimension:
135138 level : 2
136139 measure : Pinning of artifacts ensure that changes are performed only when intended.
137140 name : Pinning of artifacts
141+ isImplemented : false
138142 references :
139143 iso27001-2017 :
140144 - 14.2.6
@@ -162,6 +166,7 @@ dimension:
162166 - ' 8.1'
163167 - ' 8.2'
164168 level : 2
169+ isImplemented : true
165170 measure : Creation of an SBOM of components (e.g. application and container image
166171 content) during build.
167172 name : SBOM of components
@@ -184,6 +189,7 @@ dimension:
184189 CI/CD tools such as jenkins, gitlab-ci or github-actions
185190 - name : Container technologies and orchestration like Docker, Kubernetes # string
186191 level : 3
192+ isImplemented : true
187193 measure : Digitally signing commits helps to prevent unauthorized manipulation
188194 of source code.
189195 name : Signing of code
@@ -210,6 +216,7 @@ dimension:
210216 description : CI/CD tools such as jenkins, gitlab-ci or github-actions
211217 - name : Container technologies and orchestration like Docker, Kubernetes # string
212218 level : 3
219+ isImplemented : false
213220 measure : Digitally signing artifacts for all steps during the build and especially
214221 docker images, helps to ensure their integrity.
215222 name : Signing of artifacts
@@ -244,6 +251,7 @@ dimension:
244251 measure : A defined deployment process significantly lowers the likelihood of
245252 errors during the deployment phase.
246253 name : Defined deployment process
254+ isImplemented : true
247255 references :
248256 iso27001-2017 :
249257 - 12.1.1
@@ -267,6 +275,7 @@ dimension:
267275 description : CI/CD tools such as jenkins, gitlab-ci or github-actions
268276 - name : Container technologies and orchestration like Docker, Kubernetes # string
269277 level : 2
278+ isImplemented : false
270279 measure : ' Configuration parameters are set for each environment not in the source
271280 code.
272281
@@ -306,6 +315,7 @@ dimension:
306315 - 15.1.3
307316 - 14.1.3
308317 level : 2
318+ isImplemented : true
309319 measure : Create image assessment criteria, perform an evaluation of images and
310320 create a whitelist of artifacts/container images/virtual machine images.
311321 name : Usage of trusted images
@@ -320,6 +330,7 @@ dimension:
320330 resources : 1
321331 time : 2
322332 level : 2
333+ isImplemented : false
323334 measure : By having a clear decommissioning process, applicaitons not used are
324335 not running anymore and can therefore not be explointed.
325336 name : Defined decommissioning process
@@ -352,6 +363,7 @@ dimension:
352363 - 14.2.2
353364 - 17.2.1
354365 level : 3
366+ isImplemented : true
355367 measure : A deployment without downtime is performed*.
356368 name : Rolling update on deployment
357369 risk :
@@ -377,6 +389,7 @@ dimension:
377389 - 14.2.8
378390 - 12.1.4
379391 level : 3
392+ isImplemented : false
380393 measure : Building an artifact once and deploying it to different environments
381394 means that only tested artifacts are allowed to reach the production environment
382395 name : Same artifact for environments
@@ -404,6 +417,7 @@ dimension:
404417 file system. Also, the usage of a credential management system can help protect
405418 credentials.
406419 name : Handover of confidential parameters
420+ isImplemented : true
407421 references :
408422 iso27001-2017 :
409423 - 14.1.3
@@ -439,6 +453,7 @@ dimension:
439453 - 14.2.9
440454 - 12.1.4
441455 level : 3
456+ isImplemented : false
442457 measure : Usage of environment independent configuration parameter, called feature
443458 toggles, helps to enhance the test coverage. Only what has been tested, goes
444459 to production.
@@ -464,6 +479,7 @@ dimension:
464479 - ' 8.1'
465480 - ' 8.2'
466481 level : 3
482+ isImplemented : true
467483 measure : A documented inventory or a possibility to gather the needed information.
468484 name : Inventory of running artifacts
469485 risk :
@@ -492,6 +508,7 @@ dimension:
492508 - ' 8.1'
493509 - ' 8.2'
494510 level : 3
511+ isImplemented : false
495512 measure : A documented inventory of dependencies used in images and containers
496513 exists.
497514 name : Inventory of dependencies
@@ -517,6 +534,7 @@ dimension:
517534 description : CI/CD tools such as jenkins, gitlab-ci or github-actions
518535 - name : Container technologies and orchestration like Docker, Kubernetes # string
519536 level : 4
537+ isImplemented : true
520538 measure : By having multiple production environments, a deployment can be performant
521539 on the first environment to spot possible defects before it is deployment
522540 in the production environment(s)
0 commit comments