Software Trust & Transparency: 

Artifacts

November 2021

Matt Fussa

Trust Strategy Officer
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

Artifacts

Evidence that demonstrates that an organization 

is:

• following a documented process or meeting a 

specific requirement;

• Are gathered and archived throughout the 

system development life cycle;

• are to be used as evidence in internal and/or 

external audits and assessments.
Secure Development Lifecycle

Cisco Secure

Development Lifecycle.

Repeatable. Measurable. Resilient. 

Trustworthy.

• Rigorous, evolving product security 

baseline

• Minimizes vulnerabilities, 

enhances security

• Embeds security across 

the portfolio
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5

SECURITY

DevSecOps
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

SW Development: Robust Process = Substantive Artifacts 

Build Environment Security Standard EO 14028 – Section 4, Enhanced Software Supply Chain Security

• Inventory & Attribution

• Hardening

• Vulnerability Management

• Logging and Monitoring

• Segmentation

• Access 

• Superuser guardrails

• Source Requirements

• Build Requirements

• Provenance Requirements

(A) using administratively separate build environments;

(B) auditing trust relationships;

(C) establishing multi-factor, risk-based authentication and conditional access 

(D) documenting and minimizing dependencies on enterprise products that are 

part of the environments used to develop, build, and edit software;

(E) employing encryption for data; and

(F) monitoring operations and alerts and responding to attempted and actual

cyber incidents;

(ii) providing artifacts that demonstrate conformance to subsection (e)(i)

(iii) employing automated tools/processes to maintain trusted source code 

supply chains

(iv) employing automated tools, or comparable processes, that check for known 

and potential vulnerabilities and remediate them.

(v) providing artifacts of the execution of the tools and processes described in 

subsection (e)(iii) and (iv)

(vi) maintaining accurate and up-to-date data, provenance (i.e., origin) of software 

code or components, and controls on internal and third-party software 

components tools, and services present in software development processes 

through audits

(vii) providing a purchaser a Software Bill of Materials (SBOM) 

(viii) participating in a vulnerability disclosure program that includes a reporting and 

disclosure process;

(ix) attesting to conformity with secure software development practices; and

(x) ensuring and attesting to the integrity and provenance of open source 

software used within any portion of a product.
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

Artifacts from Secure 

SW Development

People - Process – Technology - Policy

• Identified and accountable SW Security Lead

• Two-person review before commits

• Attribution down to developer

• Documented Policy & Process 

• Security assessment of build environment

• Security Assessment of 3d party code

• Use of approved base images

• Approved code library

• Use of antimalware solution in build environment

• Use of encryption within build environment 

• Use & follow vulnerability management standard

• Security & visibility 

• Secure logging standards

• Build environment/production environment segmentation

• Source code management system

• SBOM
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

SLSA Security Levels

1

Basic Protection

2

Medium Protection

3

Advanced Protection

4

Maximum Protection
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

Sharing Artifacts
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

https://www.cisco.com/c/en/us/

about/trust-center.html

https://trustportal.cisco.com/c/r/ctp/tr

ust-portal.html#/
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

Example: Trust Package
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

Generic Security Vision for “Guided Experiences”

Suggestion: 

Add Tiles to Trust 

Portal Homepage 

to initiate “Guided 

Experiences”

Conduct Supplier 

Security Assessment 

Conduct Product/Offer 

Security Due Diligence

Partners with Customer 

Security Questions 
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public

Vision for SW Security “Guided Experiences”

Suggestion: 

Add Tiles to Trust 

Portal Homepage 

to initiate “Guided 

Experiences” for 

SW Security

Conduct Supplier SW 

Security Assessment 

SW Security Process, 

Policy & Controls

SW Security Evidence

(logs, records, data)