Every DSB rule maps to recognized industry guidance. The mappings are authored
inline in SKILL.md §3 and inverted here so a framework control can be
traced to the DSB rules that carry it.
Industry Standards / Best Practices
↓
DSB DevSecOps Engineering Methodology
↓
DSB Rules
↓
Organizational Context
↓
Platform / Tool Implementation
Frameworks inform the DSB methodology. They do not replace engineering judgment, and a mapping is not a claim of certification or full coverage of the referenced framework.
| Framework | Controls referenced | DSB rules citing it |
|---|---|---|
| NIST SSDF | 18 | 39 |
| SLSA | 4 | 13 |
| OWASP SAMM | 3 | 5 |
| OWASP CI/CD | 8 | 17 |
| CNCF | 7 | 12 |
Secure Software Development Framework (SP 800-218).
| Control | DSB rules |
|---|---|
PO.1.1 |
DSB-IAC-003 |
PO.3.1 |
DSB-DEPLOY-004 |
PO.4.1 |
DSB-EVD-001, DSB-EVD-002 |
PO.5.1 |
DSB-BUILD-004, DSB-ID-001, DSB-ID-002, DSB-ID-004, DSB-SCAN-005, DSB-SRC-003 |
PO.5.2 |
DSB-ID-003, DSB-SCAN-003, DSB-SRC-001 |
PS.1.1 |
DSB-BUILD-001, DSB-SCAN-003 |
PS.2.1 |
DSB-ART-002 |
PS.3.1 |
DSB-ART-001, DSB-ART-004, DSB-BUILD-001, DSB-DEPLOY-002 |
PS.3.2 |
DSB-ART-003, DSB-BUILD-003 |
PW.4.1 |
DSB-BUILD-002, DSB-SC-001, DSB-SC-003, DSB-SCAN-002, DSB-SCAN-004 |
PW.4.4 |
DSB-SCAN-008 |
PW.7.1 |
DSB-SCAN-001, DSB-SRC-002 |
PW.7.2 |
DSB-TEST-001 |
PW.8.1 |
DSB-IAC-001, DSB-SCAN-001 |
PW.8.2 |
DSB-DEPLOY-001, DSB-EXC-003, DSB-IAC-004, DSB-TEST-001, DSB-TEST-002 |
RV.1.1 |
DSB-DEPLOY-001, DSB-DEPLOY-003, DSB-EVD-001, DSB-SCAN-002, DSB-SCAN-004, DSB-SCAN-006 |
RV.2.1 |
DSB-EVD-003 |
RV.2.2 |
DSB-EXC-001, DSB-EXC-002 |
Supply-chain Levels for Software Artifacts.
| Control | DSB rules |
|---|---|
build-L1 |
DSB-ART-001, DSB-BUILD-001 |
build-L2 |
DSB-ART-002, DSB-ART-003, DSB-ART-004, DSB-BUILD-002, DSB-BUILD-003, DSB-DEPLOY-002, DSB-SC-001, DSB-SCAN-004 |
build-L3 |
DSB-ART-003, DSB-BUILD-004, DSB-SC-002 |
source-L2 |
DSB-SRC-002 |
Software Assurance Maturity Model.
| Control | DSB rules |
|---|---|
governance-policy |
DSB-EXC-001 |
verification-security-testing |
DSB-SCAN-001, DSB-SCAN-006, DSB-SCAN-007 |
verification-testing |
DSB-TEST-001 |
OWASP Top 10 CI/CD Security Risks.
| Control | DSB rules |
|---|---|
CICD-SEC-1 |
DSB-EXC-003, DSB-SCAN-001, DSB-SCAN-005, DSB-SRC-001 |
CICD-SEC-2 |
DSB-ID-001, DSB-ID-002, DSB-ID-004 |
CICD-SEC-3 |
DSB-SC-002, DSB-SCAN-002 |
CICD-SEC-4 |
DSB-SCAN-004, DSB-SRC-003 |
CICD-SEC-5 |
DSB-BUILD-004, DSB-SCAN-005 |
CICD-SEC-6 |
DSB-ID-003, DSB-SCAN-003 |
CICD-SEC-9 |
DSB-IAC-001, DSB-IAC-002 |
CICD-SEC-10 |
DSB-EVD-002 |
CNCF Software Supply Chain Security guidance.
| Control | DSB rules |
|---|---|
artifact-signing |
DSB-ART-002 |
artifact-verification |
DSB-ART-004, DSB-SCAN-004 |
build-integrity |
DSB-BUILD-001, DSB-SC-002 |
dependency-management |
DSB-BUILD-002, DSB-SC-001, DSB-SC-003, DSB-SCAN-002 |
provenance |
DSB-ART-003 |
sbom |
DSB-BUILD-003 |
workload-security |
DSB-IAC-002 |
| Rule | Title | Frameworks |
|---|---|---|
DSB-BUILD-001 |
Builds execute from version-controlled source | NIST SSDF PS.1.1, PS.3.1; SLSA build-L1; CNCF build-integrity |
DSB-BUILD-002 |
Dependency resolution is controlled and repeatable | NIST SSDF PW.4.1; SLSA build-L2; CNCF dependency-management |
DSB-BUILD-003 |
A software bill of materials is produced for each deployable artifact | NIST SSDF PS.3.2; SLSA build-L2; CNCF sbom |
DSB-BUILD-004 |
Build environments are ephemeral | NIST SSDF PO.5.1; SLSA build-L3; OWASP CI/CD CICD-SEC-5 |
DSB-TEST-001 |
Automated tests execute before security scanning | NIST SSDF PW.7.2, PW.8.2; OWASP SAMM verification-testing |
DSB-TEST-002 |
Infrastructure changes are validated before application | NIST SSDF PW.8.2 |
DSB-SCAN-001 |
Static application security testing | NIST SSDF PW.7.1, PW.8.1; OWASP SAMM verification-security-testing; OWASP CI/CD CICD-SEC-1 |
DSB-SCAN-002 |
Software composition analysis | NIST SSDF PW.4.1, RV.1.1; OWASP CI/CD CICD-SEC-3; CNCF dependency-management |
DSB-SCAN-003 |
Secret scanning of source and history | NIST SSDF PO.5.2, PS.1.1; OWASP CI/CD CICD-SEC-6 |
DSB-SCAN-004 |
Container image vulnerability scanning | NIST SSDF PW.4.1, RV.1.1; SLSA build-L2; OWASP CI/CD CICD-SEC-4; CNCF artifact-verification |
DSB-SCAN-005 |
Pipeline configuration security analysis | NIST SSDF PO.5.1; OWASP CI/CD CICD-SEC-1, CICD-SEC-5 |
DSB-SCAN-006 |
Dynamic application security testing | NIST SSDF RV.1.1; OWASP SAMM verification-security-testing |
DSB-SCAN-007 |
API security testing | OWASP SAMM verification-security-testing |
DSB-SCAN-008 |
Dependency license and compliance analysis | NIST SSDF PW.4.4 |
DSB-IAC-001 |
Infrastructure-as-code static analysis | NIST SSDF PW.8.1; OWASP CI/CD CICD-SEC-9 |
DSB-IAC-002 |
Kubernetes and workload configuration analysis | OWASP CI/CD CICD-SEC-9; CNCF workload-security |
DSB-IAC-003 |
Policy-as-code enforcement | NIST SSDF PO.1.1 |
DSB-IAC-004 |
Infrastructure changes are reviewed before application to production | NIST SSDF PW.8.2 |
DSB-SRC-001 |
Deployable branches are protected | NIST SSDF PO.5.2; OWASP CI/CD CICD-SEC-1 |
DSB-SRC-002 |
Changes are reviewed before merge | NIST SSDF PW.7.1; SLSA source-L2 |
DSB-SRC-003 |
Untrusted contributions cannot access privileged pipeline context | NIST SSDF PO.5.1; OWASP CI/CD CICD-SEC-4 |
DSB-SC-001 |
Dependencies resolve through a controlled source | NIST SSDF PW.4.1; SLSA build-L2; CNCF dependency-management |
DSB-SC-002 |
Third-party pipeline components are pinned to immutable references | SLSA build-L3; OWASP CI/CD CICD-SEC-3; CNCF build-integrity |
DSB-SC-003 |
Newly introduced dependencies are evaluated before adoption | NIST SSDF PW.4.1; CNCF dependency-management |
DSB-ART-001 |
Artifacts are published to a controlled registry | NIST SSDF PS.3.1; SLSA build-L1 |
DSB-ART-002 |
Artifacts are signed where required | NIST SSDF PS.2.1; SLSA build-L2; CNCF artifact-signing |
DSB-ART-003 |
Build provenance is recorded | NIST SSDF PS.3.2; SLSA build-L2, build-L3; CNCF provenance |
DSB-ART-004 |
Deployed artifacts are verified by immutable identity | NIST SSDF PS.3.1; SLSA build-L2; CNCF artifact-verification |
DSB-DEPLOY-001 |
Only artifacts that passed required controls are deployed | NIST SSDF PW.8.2, RV.1.1 |
DSB-DEPLOY-002 |
Validated artifacts are promoted, not rebuilt | NIST SSDF PS.3.1; SLSA build-L2 |
DSB-DEPLOY-003 |
Production deployment follows validation in a lower environment | NIST SSDF RV.1.1 |
DSB-DEPLOY-004 |
Deployment is automated and reproducible | NIST SSDF PO.3.1 |
DSB-ID-001 |
Pipelines authenticate with short-lived federated identity | NIST SSDF PO.5.1; OWASP CI/CD CICD-SEC-2 |
DSB-ID-002 |
Deployment identity follows least privilege | NIST SSDF PO.5.1; OWASP CI/CD CICD-SEC-2 |
DSB-ID-003 |
Secrets are not stored in pipeline definitions or source | NIST SSDF PO.5.2; OWASP CI/CD CICD-SEC-6 |
DSB-ID-004 |
Environment credentials are separated | NIST SSDF PO.5.1; OWASP CI/CD CICD-SEC-2 |
DSB-EVD-001 |
Security control results are retained as evidence | NIST SSDF PO.4.1, RV.1.1 |
DSB-EVD-002 |
Pipeline execution is auditable | NIST SSDF PO.4.1; OWASP CI/CD CICD-SEC-10 |
DSB-EVD-003 |
Findings reach an owning team | NIST SSDF RV.2.1 |
DSB-EXC-001 |
Exceptions are explicit, owned, and time-bound | NIST SSDF RV.2.2; OWASP SAMM governance-policy |
DSB-EXC-002 |
Suppressions reference an exception | NIST SSDF RV.2.2 |
DSB-EXC-003 |
Controls are not disabled inline to pass a build | NIST SSDF PW.8.2; OWASP CI/CD CICD-SEC-1 |