PW.4.1 Reuse Trusted Software Components
Acquire and reuse well secured software components rather than creating new ones for common functions. Track the origin and version of each component and verify its provenance.
4
artefacts
1
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Provenance verification logs · SIEM / log platform
periodic reviewEvidence produced at each review
- Component intake review process · Document repository
governing documentDocuments that govern the control
- Approved component catalog · Document repository
- Deprecation process for risky components · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- no central catalog of approved components
- intake review skipped under time pressure
- components remain in use after the upstream project is abandoned
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPW.2.1 Qualified Review of Software Design · PW.4.2 Maintain Well-Secured In-House Components