Security frameworks and industry best practices in Tanzu Application Catalog

Security frameworks are a set of well-documented standards, policies, procedures, and best practices designed to enhance an organization’s security posture and minimize risks. These frameworks offer a standardized approach for organizations to build security solutions, deploy security controls, identify threats and vulnerabilities, and the strategies for mitigation.

These frameworks are often dictated by government agencies and IT organizations to provide businesses and companies with clear recommendations to follow when building and producing products for customers that will operate in highly regulated environments.

VMware Tanzu Application Catalog complies with the following security frameworks and cybersecurity agencies’ guidelines to enhance organizational security and minimize risks:

Category Framework Authority
Software Supply Chain
Supply Chain Levels for Software Artifacts (SLSA) Open Source Security Foundation (OpenSSF)
Vulnerability Exploitability eXchange (VEX) use case recommendations Cybersecurity and Infrastructure Security Agency (CISA)
DISA’s container image creation and deployment guide Defense Information Systems Agency (DISA) for the U.S. Department of Defense (DoD)
Center for Internet Security (CIS) Benchmark for Docker CIS
Security Technical Implementation Guide (STIG) Defense Information Systems Agency (DISA) for the U.S. Department of Defense (DoD)
[Pod Security Standards] Kubernetes hardening best practices
check-circle-line exclamation-circle-line close-line
Scroll to top icon