VMware Tanzu Application Service Compliance
VMware develops VMware Tanzu Application Service using a modern, agile software development process. The development processes followed for Cloud Foundry are supported by issue-tracking tools such as GitHub repositories and GitHub issues, and Pivotal Tracker. All changes made to the software are traceable via the corresponding git commit logs, and Pivotal Tracker story activities. Pivotal Tracker provides workflow support that enables a team to track a work item from inception, through development, delivery, and acceptance. Repeatable build and deployment processes may be achieved using tools such as GitHub and Concourse pipelines. VMware Tanzu Application Service is based upon the open source software distribution of Cloud Foundry, and includes additional proprietary (closed-source) components and services. Product documentation is provided for both the OSS and commercial components. All software releases are accompanied by release notes that describe new features, included bug fixes, CVEs, and known issues.
At runtime, the BOSH director database and the Tanzu Operations Manager tooling provide the configuration management capability for the Tanzu Application Service deployment.
Configuration management of the deployed application code is the responsibility of the application developer, but similar solution patterns may be applied.
Control Description
The organization requires the developer of the information system, system component, or information system service to:
- Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation];
- Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management];
- Implement only organization-approved changes to the system, component, or service;
- Document approved changes to the system, component, or service and the potential security impacts of such changes; and
- Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].
Supplemental Guidance
This control also applies to organizations conducting internal information systems development and integration. Organizations consider the quality and completeness of the configuration management activities conducted by developers as evidence of applying effective security safeguards. Safeguards include, for example, protecting from unauthorized modification or destruction, the master copies of all material used to generate security-relevant portions of the system hardware, software, and firmware. Maintaining the integrity of changes to the information system, information system component, or information system service requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes. Configuration items that are placed under configuration management (if existence/use is required by other security controls) include: the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and software/firmware source code with previous versions; and test fixtures and documentation. Depending on the mission/business needs of organizations and the nature of the contractual relationships in place, developers may provide configuration management support during the operations and maintenance phases of the life cycle.
