Reference Library¶
This library records the primary standards and official technical sources used for foundational claims in this knowledge center. It was reviewed on 2026-08-30. Product-specific measurements remain governed by the artifact digest, observation date, and tool context on the page where they appear.
Container and development security¶
- NIST SP 800-190 — Application Container Security Guide identifies security risks and countermeasures across container images, registries, orchestrators, containers, and host operating systems.
- NIST SP 800-218 — Secure Software Development Framework provides outcome-based secure software development practices that can be integrated into a software lifecycle.
- OCI Image Specification defines interoperable image manifests, indexes, configurations, layers, descriptors, and content-addressable identity.
- Microsoft .NET container images documents Microsoft's official .NET image families, tags, supported architectures, and image variants.
Software transparency¶
- SPDX Specifications is the official specification source for SPDX software bill of materials and related supply-chain data.
- CycloneDX Specification Overview is the official specification source for CycloneDX bill-of-materials and related component-risk formats.
- CISA Minimum Requirements for VEX defines minimum fields and status expectations for communicating vulnerability exploitability.
Provenance, identity, and vulnerability priority¶
- SLSA v1.2 Provenance defines verifiable information describing where, when, and how an artifact was produced.
- Sigstore Cosign verification documents verification of signatures and keyless identities, including expected OIDC issuer and certificate identity.
- CISA Known Exploited Vulnerabilities Catalog is the authoritative catalog of vulnerabilities known to have been exploited in the wild for CISA's binding directive and a priority input to the Indian Hill Labs assessment model.
Use and maintenance¶
External standards evolve independently of this site. A page that depends on a particular version records that version locally. Canonical links above are preferred over copied summaries, and material changes are reviewed before they alter an Indian Hill Labs requirement or assurance claim.