ISO 27001: formalise secure SDLC, vulnerability management and release provenance

[stephane-segning]

Context

vsms already has strong CI and release practices, but ISO/IEC 27001 readiness requires secure-development and vulnerability-management controls to be explicit, consistently enforced and evidenced.

Relevant control themes include secure development lifecycle, application security requirements, secure coding, security testing, technical vulnerability management, change management and supply-chain integrity.

Scope

Document and enforce the secure path from requirement/change through review, CI, artifact publication and deployment. Include dependency/advisory scanning, security exceptions, remediation targets, release provenance and third-party action/tool pinning.

Reuse existing supply-chain work such as #354 rather than creating a parallel provenance mechanism.

Acceptance

• Secure-SDLC runbook/policy reference defines mandatory review, testing and release gates.
• Security-relevant changes have a repeatable threat/security review trigger.
• Dependency and vulnerability scanning are required CI gates with a documented exception/risk-acceptance path.
• Findings have severity, owner, due date/remediation target and closure evidence.
• Release artifacts have verifiable provenance where the ecosystem supports it; npm Trusted Publishing is still bound to the old owner: v0.3.1 shipped without provenance #354 is resolved or explicitly treated as an open control gap.
• Mutable third-party CI actions/tools are pinned or justified through risk treatment.
• CI/release evidence is retained or reproducibly queryable for audited releases.
• Emergency changes have an auditable path and retrospective review.