Tag

#compliance

Tagged “compliance”

3 articles

CISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship

The CISA report 'Open Source Software: Security Principles and Practices' argues open source can be as safe as proprietary software, provided consumers score each component against a C4 framework (Codebase, Community, Conduct, Configuration). For any CI/CD team selling into regulated buyers, that scoreboard is going to arrive as an audit checklist.

Aug 3, 2026 · Tomás Vega Security & supply chain

CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS

The 2026 Minimum Elements guidance from CISA replaces the 2021 NTIA baseline, adds required hash, license and generation-context fields to every SBOM, renames Supplier Name to Component Producer, and extends the floor to open-source software, AI systems and software-as-a-service. For platform teams the practical consequence is that SBOM work stops living inside the build step and starts spilling into vendor contracts and runtime re-validation.

Aug 2, 2026 · Maya Okonkwo Security & supply chain

Auditors, OIDC and the trust policy most teams get wrong

A DevOps.com walkthrough by Artur Yolchyan lays out a SOC 2-shaped CI/CD pipeline on GitHub Actions and AWS: multi-account isolation, OIDC federation locked to one repo and branch, and the same container image retagged all the way to production. The interesting part is not the account topology; it is the one line in the trust policy that decides who can talk to your ECR.

Jul 24, 2026 · Tomás Vega