Supply Chain Security 101
Everything you need to know about software supply chain security in the age of open source.
- ComplianceSoftware Supply Chain
CISA Secure Software Development Attestation Form: Requirements and SSDF references
See what the CISA Secure Software Development Attestation Form covers, how each requirement maps to SSDF practices, and why agencies no longer must collect it.
- Compliance
Understanding FIPS: Standards, validation, and compliance
Learn what FIPS is, who needs FIPS validation, how CMVP validation works, and what approved algorithms and cryptographic boundaries mean for compliance.
- Compliance
What is PCI DSS 4.0? Goals, requirements, and who must comply
Learn what PCI DSS 4.0 is, who must comply, the 6 goals and 12 requirements that protect cardholder data, and the fines and risks that come with non-compliance.
- Compliance
CMMC 2.0 practices and domains
See all 14 CMMC 2.0 practice domains, how practices are named and numbered, and how Level 1's 17 and Level 2's 110 practices map to NIST SP 800-171.
- Software Supply Chain
What is the Open Container Initiative (OCI)?
Learn what the Open Container Initiative (OCI) is, how its image, runtime, and distribution specs work, and how to tell if an image is OCI compliant.
- AppSecSoftware Supply Chain
What is OpenVEX?
OpenVEX tells scanners whether a CVE actually affects your software. Learn how the OpenVEX specification works and how to pair VEX documents with SBOMs.
- AppSec
What are software vulnerabilities and CVEs, and why do they matter?
Learn what makes a software vulnerability, how the CVE Program, CVSS, and CWE score them, and why unpatched CVEs put your data and compliance at risk.
- DevSecOpsSoftware Supply Chain
What is a build horizon?
A build horizon sets a maximum age for software artifacts. Learn why it stops CVE buildup and how to enforce it with automated updates, rebuilds, and policy.
- Software Supply Chain
What are containers?
Learn what containers are, how they differ from virtual machines, what's inside a container image, and how minimal base images reduce size and CVEs.
- Compliance
What is CMMC 2.0? Maturity levels and requirements
Learn what CMMC 2.0 is, which defense contractors must comply, how FCI and CUI differ, and what each maturity level requires, from 17 practices to 110 and more.
- ComplianceAppSec
What are CIS Benchmarks?
Learn what CIS Benchmarks are, how Level 1 and Level 2 profiles work, and how the CIS Docker Benchmark applies to hardening container images for compliance.
- AppSec
CVE remediation: How to find and fix software vulnerabilities
Learn the four steps of CVE remediation: inventory your software, scan for vulnerabilities, triage with CVSS, KEV, and VEX, then patch and rescan to confirm.