Explorer
KNOW-REF-056

OWASP SPVS — Secure Pipeline Verification Standard

Domaine
cybersecu
Type
reference
Priorité
P2

OWASP SPVS

Description

Secure Pipeline Verification Standard — framework pour évaluer, améliorer et standardiser la sécurité des pipelines de delivery logiciel sur tout le lifecycle.

5 stages

  1. Plan — Secure code management, threat modeling, lessons learned
  2. Develop — Secure coding standards, automated vulnerability detection
  3. Integrate — CI/CD security controls, artifact integrity
  4. Release — Build environment protection, release assurance
  5. Operate — Compliance monitoring, incident response, operational resilience

Caractéristiques

  • Multi-tiered maturity model (baseline → advanced)
  • Aligné avec CIS Benchmarks, OWASP ASVS, cloud Well-Architected Frameworks
  • Support multi-cloud, hybrid, on-premise
  • Adaptable Agile, DevOps, DevSecOps, Platform Engineering
  • Intégration GitHub Actions, GitLab, Jenkins, Azure DevOps

Références

  • OWASP SPVS
  • [[KNOW-REF-055]] — DSOVS (complémentaire)
  • [[KNOW-REF-048]] — DevSecOps Guideline