PSS-02 Identification of Vulnerabilities of the Cloud Service
Build vulnerability detection into the software development process for the service, using a risk based mix of static and dynamic application security testing, expert code review and monitoring of confirmed flaws in thir
4
artefacts
3
held by a system
1
at each review
easy
to go live
Source control / CI pipeline
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Pipeline configuration showing static and dynamic security testing stages · Source control / CI pipeline
- Findings report from a recent scan with severity ratings applied · Vulnerability scanner / patch tooling
- Software composition output listing advisories for third party libraries in use · Source control / CI pipeline
periodic reviewEvidence produced at each review
- Code review records signed off by the reviewing specialist · Source control / CI pipeline
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your Source control / CI pipeline. Pull-request approvals, pipeline test results and deployment records from source control, per release.
Common gaps auditors find
- Security testing stages configured to warn only and never block a build
- Library advisories monitored for direct dependencies while transitive ones are ignored
- Severity taken from the tool default with no provider defined criteria applied
- High severity findings carried forward release after release without treatment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPSS-01 Guidelines and Recommendations for Cloud Customers · PSS-03 Online Register of Known Vulnerabilities