Skip to main content

Pro audit program · v1.0

Dependency & Supply Chain Audit

Most apps are 90% open-source dependencies. Quick check on SBOM, scanning, pinning, and what happens when a high-CVE library drops.

  • General target area
  • NIST SSDF / SLSA framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Most apps are 90% open-source dependencies. Quick check on SBOM, scanning, pinning, and what happens when a high-CVE library drops.

Controls (6)

  1. SBOM generated per build (CycloneDX / SPDX)

    High

    This control requires that a Software Bill of Materials (SBOM) in CycloneDX or SPDX format be automatically generated for every software build. The SBOM inventories all components, libraries, dependencies, and their versions, creating a machine-readable artifact that accompanies each build…

    How to test + evidence

    Testing procedure: CI emits and stores an SBOM per release.

    Evidence to collect: SBOM artefact + retention.

  2. SCA scanning blocks builds on critical CVEs

    Critical

    Software Composition Analysis (SCA) scanning is integrated into the continuous integration/continuous deployment (CI/CD) pipeline to automatically detect known vulnerabilities (CVEs) in third-party libraries and dependencies. When critical-severity CVEs are identified during a build, the pipeline is configured to fail the…

    How to test + evidence

    Testing procedure: Software composition analysis scans dependencies; high / critical CVEs fail the build.

    Evidence to collect: SCA tool + policy.

  3. Dependency lockfile committed + reviewed

    High

    This control requires that dependency lockfiles (such as package-lock.json, Gemfile.lock, poetry.lock, or go.sum) be committed to version control repositories and subjected to code review processes before merging. Lockfiles pin exact versions and cryptographic hashes of all direct and transitive dependencies,…

    How to test + evidence

    Testing procedure: package-lock / go.sum / Cargo.lock / poetry.lock under review.

    Evidence to collect: Repo settings.

  4. Package registry allowlist (private mirror)

    High

    Package registry allowlist (private mirror) restricts software package downloads to an organization-controlled registry or mirror that proxies and caches approved packages from public sources such as npm, PyPI, Maven Central, or NuGet. Developers and build pipelines are configured to resolve…

    How to test + evidence

    Testing procedure: Builds pull from a private proxy / mirror; not direct from public registries.

    Evidence to collect: Registry config.

  5. Automated CVE alerts on monitored deps

    High

    This control ensures that organizations receive automated, real-time notifications when Common Vulnerabilities and Exposures (CVEs) are published for software dependencies used in production and development environments. It requires maintaining an inventory of monitored components (libraries, frameworks, packages) and integrating automated…

    How to test + evidence

    Testing procedure: Dependabot / Renovate / equivalent opens PRs on new CVEs.

    Evidence to collect: Tool config + last PR.

  6. Signed releases / SLSA provenance

    Medium

    This control ensures that software artifacts (binaries, containers, packages) are cryptographically signed by authorized build systems and accompanied by Supply-chain Levels for Software Artifacts (SLSA) provenance metadata. SLSA provenance provides tamper-evident attestations documenting the origin, build environment, dependencies, and build…

    How to test + evidence

    Testing procedure: Build artefacts signed; provenance attestation generated.

    Evidence to collect: Signing config + sample.