What it covers. A set of high-level secure software development practices that can be added to any development life cycle. The practices are grouped into four areas: preparing the organisation, protecting the software, producing well-secured software and responding to vulnerabilities. It is widely referenced for software supplier attestation.
In practice. Applying it well means mapping your existing development process to the practices and closing gaps, for example threat modelling, code review, automated testing, protection of build systems and code signing. Teams keep records that show practices are followed, such as pipeline configurations, review records, software bills of materials and a vulnerability response process. Buyers can use the same practices to frame questions to suppliers.
Common gaps. Gaps typically include unprotected build environments, no structured way to receive and handle vulnerability reports, and practices that exist on paper but are not enforced in the pipeline.