OWASP SPVS
Description
Secure Pipeline Verification Standard — framework pour évaluer, améliorer et standardiser la sécurité des pipelines de delivery logiciel sur tout le lifecycle.
5 stages
- Plan — Secure code management, threat modeling, lessons learned
- Develop — Secure coding standards, automated vulnerability detection
- Integrate — CI/CD security controls, artifact integrity
- Release — Build environment protection, release assurance
- Operate — Compliance monitoring, incident response, operational resilience
Caractéristiques
- Multi-tiered maturity model (baseline → advanced)
- Aligné avec CIS Benchmarks, OWASP ASVS, cloud Well-Architected Frameworks
- Support multi-cloud, hybrid, on-premise
- Adaptable Agile, DevOps, DevSecOps, Platform Engineering
- Intégration GitHub Actions, GitLab, Jenkins, Azure DevOps
Références
- OWASP SPVS
- [[KNOW-REF-055]] — DSOVS (complémentaire)
- [[KNOW-REF-048]] — DevSecOps Guideline