# sboms Published articles for sboms. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Understanding platform engineering's role in staying compliant with the EU's CRA DevFeed: [Understanding platform engineering's role in staying compliant with the EU's CRA]() Original publisher: [Read original article]() Author: Nigel Douglas Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Security](), [vulnerability management](), [supply-chain-security](), [incident]() Tags: [compliance](), [cyber-resilience-act](), [engineering](), [eu](), [idp](), [incident](), [platform](), [platform-engineering](), [policy](), [regulatory](), [sboms](), [secure-by-default](), [secure-software](), [security](), [software-supply-chain](), [supply-chain](), [vulnerabilities](), [vulnerability-management]() ### AI overview The article explains how platform engineering can operationalize compliance with the EU's Cyber Resilience Act by embedding secure-by-default practices, automated SBOMs, and rapid incident reporting into an Internal Development Platform. It also outlines CRA compliance milestones and manufacturer responsibilities, including vulnerability management and security updates. ### Source excerpt The EU's Cyber Resilience Act (CRA) mandates secure software by design. Discover how platform engineering operationalizes compliance by embedding secure-by-default standards, automated SBOMs, and rapid incident reporting into your Internal Development Platform (IDP). This approach transforms compliance into a frictionless golden path ## CTRL-OS 26.05 Released! DevFeed: [CTRL-OS 26.05 Released!]() Original publisher: [Read original article]() Author: blitz Published: 2026-07-10T12:35:43Z Content type: release Language: en Sources: [Announcements - NixOS Discourse]() Topics: [Nix](), [Linux](), [maintenance](), [Security](), [cyber resilience act]() Tags: [announcements](), [cyber-resilience-act](), [infrastructure](), [linux](), [maintenance](), [release](), [sboms](), [security]() ### AI overview CTRL-OS 26.05, a downstream distribution of NixOS, has been released. The release provides a five-year lifecycle model, beginning with co-maintenance while NixOS has community support and moving to stability maintenance afterward. CTRL-OS monitors and backports security fixes for a core package set, with commercial subscriptions supporting SLAs and custom package sets. The project also describes its role in helping embedded Linux products address long-term vulnerability patching and EU Cyber Resilience Act requirements. ### Source excerpt Welcome to the latest CTRL-OS update! Find the last update from April here. If you don't know yet, CTRL-OS is a downstream distribution of NixOS designed to extend the release lifecycle to 5 years. It gives you a stable foundation with commercial support so you can build your products without having to maintain the packages you depend on. CTRL-OS 26.05 Released! The CTRL-OS 26.05 release is finally out. You can find the release blog post on our website. Or head over to our technical documentation and try it out. As long as NixOS 26.05 has community support, CTRL-OS 26.05 will be in the co-maintenance phase. In this phase, we will monitor our supported package set and contribute any security fixes back to NixOS. After community support ends, we enter the stability phase, and maintenance shifts completely to us. We've detailed this model on our blog. As of now, we support a small but useful package set. We'll share more details here soon, but our goal is to cover the usual packages you deploy on a server or embedded system, i.e., that dusty plastic box in the corner that quietly does its job for years. We actively monitor and backport CVEs for a core set of packages. To fund this work, commercial subscriptions provide SLA guarantees and cover custom package sets. While we aim to stay very close to NixOS 26.05, we will pull in important security fixes quickly to keep our SLAs. This creates a divergence that will automatically resolve itself once the security fixes make it to the NixOS release branch as well. Finally, to avoid a maintenance burden for the community, our CTRL-OS 26.05 release is lightly branded. By making it easy to identify a CTRL-OS system via nix-env -m, we ensure that bug reports originating from CTRL-OS users don't accidentally get filed against upstream NixOS, respecting the time and effort of upstream maintainers. No Cyber Resilience Act (CRA) Worries With the EU's CRA requirements taking effect this September, shipping embedded Linux products is ## Adopt hardened containers without changing your pipelines, tooling, or environment DevFeed: [Adopt hardened containers without changing your pipelines, tooling, or environment]() Original publisher: [Read original article]() Published: 2026-06-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [chainguard containers](), [Security](), [Deployment](), [Tooling]() Tags: [chainguard](), [chainguard-containers](), [chainguard-redhat-rpm](), [cmvp](), [compliance](), [containers](), [cyclonedx](), [dependabot](), [deployment](), [fips](), [hardened-containers](), [provenance](), [rhel](), [rhel-10](), [rhel-9](), [rpm-10](), [rpm-9](), [sboms](), [secure-by-default](), [security](), [vulnerabilities]() ### AI overview Chainguard announces updates to Chainguard Containers that support enterprise adoption of hardened images without changing existing pipelines, tooling, or environments. The updates include RPM support for RHEL 9 and RHEL 10, compatible image tags, a CMVP-validated Go Geomys FIPS image, Dependabot support for private registries, and flattened CycloneDX SBOMs for compliance tools. ### Source excerpt Chainguard expands Containers with RPM support, FIPS enhancements, and easier migrations, bringing secure-by-default software to enterprise workflows. ## Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up DevFeed: [Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up]() Original publisher: [Read original article]() Published: 2026-06-23T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [Java](), [Spring Boot](), [Security](), [Back end]() Tags: [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-java](), [cve](), [cve-remediation](), [dependencies](), [java](), [java-packages](), [java-spring](), [open-source](), [provenance](), [sboms](), [scanner](), [security](), [zero-cve-packages]() ### AI overview Chainguard Libraries for Java is generally available, and its CVE remediation capability is available in beta. The article describes backported fixes for critical and high-severity CVEs across the Spring Boot ecosystem, helping teams manage risks in pinned or legacy Java dependencies while planning upgrades. ### Source excerpt Chainguard Libraries for Java is now GA, delivering CVE-remediated dependencies with SBOMs, provenance, and scanner-recognized fixes. ## Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard containers](), [container images](), [Security](), [Containers](), [chainguard libraries]() Tags: [chainguard](), [chainguard-containers](), [chainguard-gartner](), [chainguard-gartner-mq](), [chainguard-libraries](), [container-images](), [gartner](), [gartner-magic-quadrant](), [sboms](), [secure-by-default](), [security](), [software-supply-chain-security](), [software-supply-chain-security-gartner](), [software-supply-chain-security-mq](), [zero-cves]() ### AI overview Chainguard's article discusses its recognition as a Leader in Gartner's inaugural Magic Quadrant for Software Supply Chain Security. It argues that accelerating vulnerability exploitation and AI-assisted development require prevention-oriented, secure-by-default supply chain security. The article highlights Chainguard Containers, which provides minimal container images rebuilt daily from source, with zero CVEs, SBOMs, and verifiable signatures, and briefly introduces Chainguard Libraries. ### Source excerpt Gartner names Chainguard a Leader in Software Supply Chain Security, highlighting its secure-by-default approach and market vision. ## Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-18T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Security](), [Open Source]() Tags: [2026](), [chainguard](), [chainguard-gartner](), [chainguard-gartner-magic-quadrant](), [cyber-resilience-act](), [fedramp](), [gartner](), [gartner-mq-software-supply-chain](), [nis2](), [provenance](), [sboms](), [secure-by-default](), [security](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [software-supply-chain-security-gartner]() ### AI overview Chainguard announces that it has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. The article highlights Chainguard's secure-by-default approach, hardened open source artifacts, cryptographic signatures, signed SBOMs, and SLSA-aligned provenance, along with support for regulatory requirements. ### Source excerpt Chainguard named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security, recognized for vision and secure-by-default innovation. ## Building for the AI era: Chainguard partners with Endor Labs DevFeed: [Building for the AI era: Chainguard partners with Endor Labs]() Original publisher: [Read original article]() Published: 2026-05-19T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Application Security](), [Artificial Intelligence](), [AI-assisted coding](), [chainguard containers](), [Containers](), [Library](), [Agent Skill](), [CI/CD]() Tags: [agent](), [ai](), [ai-coding-agents](), [application-security](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [containers](), [cves](), [endor](), [endor-labs](), [observability](), [provenance](), [sboms](), [software-supply-chain](), [vulnerabilities]() ### AI overview Chainguard partners with Endor Labs to help teams building with AI coding agents secure the software supply chain. Chainguard provides source-built artifacts, daily rebuilds, signed SBOMs, and SLSA Level 3 provenance, while Endor Labs analyzes application context to identify vulnerabilities that are genuinely reachable and exploitable. ### Source excerpt Chainguard and Endor Labs help teams build securely at AI speed with source-built artifacts, exploitability analysis, and fewer vulnerabilities to triage. ## CMMC Phase 2, explained: Requirements, deadlines, and who's affected DevFeed: [CMMC Phase 2, explained: Requirements, deadlines, and who's affected]() Original publisher: [Read original article]() Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Security & Privacy](), [Cryptography](), [vulnerability management](), [vulnerability scanning](), [Encryption](), [MFA]() Tags: [certificates](), [cmmc](), [cmmc-container-images](), [cmmc-phase-2](), [cmvp](), [compliance](), [cve](), [cybersecurity-maturity-model-certification](), [fips](), [nist](), [sboms](), [stig](), [stigs](), [supply-chain](), [u-s-dod](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article explains the requirements, deadlines, and scope of CMMC Phase 2. It describes the CMMC Level 2 certification requirements for organizations handling Controlled Unclassified Information or supporting Department of Defense and certain civilian agency contracts, including MFA, encryption, vulnerability scanning, supported systems, independent assessments, and compliance documentation. ### Source excerpt CMMC Phase 2 and NIST 800-171 are here. Learn how Chainguard helps teams meet compliance with FIPS, STIGs, and zero-CVE containers. ## Introducing Chainguard OS Packages: Secure ingredients for custom container builds DevFeed: [Introducing Chainguard OS Packages: Secure ingredients for custom container builds]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard os](), [container images](), [Docker Hardened Images](), [Vulnerabilities](), [Linux](), [Automation](), [Dockerfile](), [Open Source](), [bazel](), [chainguard sboms](), [APK]() Tags: [apk](), [apko](), [automation](), [base-images](), [bazel](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [chainguard-os](), [chainguard-os-packages](), [chainguard-packages](), [chainguard-sboms](), [container](), [container-images](), [cve](), [dockerfiles](), [open-source](), [sboms](), [secure-software-packages](), [software-packages](), [vulnerabilities](), [zero-cve-packages]() ### AI overview Chainguard introduces Chainguard OS Packages, a service providing continuously maintained, enterprise-grade packages and base images for teams that build custom container images. Customers retain control over image composition and build tooling while Chainguard handles package sourcing, rebuilding, vulnerability remediation, and SBOM generation. ### Source excerpt Chainguard OS Packages are enterprise-grade, zero-CVE packages and base images built and continuously maintained in the Chainguard Factory. ## The tech leader's mandate: Use engineering to accelerate sales velocity DevFeed: [The tech leader's mandate: Use engineering to accelerate sales velocity]() Original publisher: [Read original article]() Published: 2026-02-04T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Security](), [supply-chain-security](), [Software Engineering](), [Development]() Tags: [chainguard](), [chainguard-containers](), [chainguard-for-startups](), [chainguard-libraries](), [chainguard-startups-pricing](), [container-images](), [containers](), [packages](), [sales](), [sboms](), [secure-by-default](), [security](), [security-compliance](), [software-supply-chain](), [velocity]() ### AI overview This article argues that security and compliance concerns can slow enterprise sales for startups. It recommends embedding security into the software development lifecycle and presents Chainguard's secure-by-default components as a way to reduce software supply chain friction while supporting product development and sales velocity. ### Source excerpt Chainguard can help your engineering team accelerate sales velocity by reducing security friction and enabling engineering to be a growth accelerator. ## Super SBOMs: See exactly what's inside DevFeed: [Super SBOMs: See exactly what's inside]() Original publisher: [Read original article]() Published: 2026-01-29T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [Containers](), [chainguard](), [Security](), [spdx]() Tags: [chainguard-containers](), [chainguard-sboms](), [containers](), [cyclonedx](), [fedramp](), [sbom](), [sboms](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vulnerability]() ### AI overview Chainguard Containers now provide richer SBOMs with binary-level details about embedded libraries and dependencies, along with CycloneDX support in addition to SPDX. The added visibility helps teams trace vulnerabilities and assess license compliance. ### Source excerpt Chainguard Containers ship richer SBOMs with binary-level library details plus new CycloneDX support, making CVE impact and compliance tracing fast and clear. ## Applying SOC 2 with Chainguard: A practical guide for DevOps and engineering leaders DevFeed: [Applying SOC 2 with Chainguard: A practical guide for DevOps and engineering leaders]() Original publisher: [Read original article]() Published: 2026-01-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [SOC](), [DevOps](), [supply-chain-security](), [Containers](), [CI/CD](), [Software as a service]() Tags: [chainguard-containers](), [chainguard-libraries](), [chainguard-sboms](), [ci-cd](), [compliance](), [containers](), [devops](), [how-does-chainguard-help-with-soc-2](), [sboms](), [secure-by-default](), [security](), [soc](), [soc-2](), [soc-2-chainguard](), [soc-2-compliance](), [software-supply-chain]() ### AI overview This practical guide explains how DevOps and engineering teams can apply SOC 2 principles to continuously changing cloud-native infrastructure and software supply chains. It covers Type 1 and Type 2 reporting, continuous control evidence, automated integrity checks, audit visibility, secure-by-default containers, and automated SBOMs, with Chainguard presented as a way to reduce audit friction without slowing delivery. ### Source excerpt Learn how Chainguard helps DevOps teams meet SOC 2 requirements with secure-by-default containers, automated SBOMs, and continuous, audit-ready evidence. ## Understanding NYDFS and why it matters DevFeed: [Understanding NYDFS and why it matters]() Original publisher: [Read original article]() Published: 2026-01-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Cybersecurity](), [Open Source](), [open-source-security](), [container images](), [CI/CD](), [vulnerability]() Tags: [chainguard](), [chainguard-containers](), [chainguard-libraries](), [chainguard-sboms](), [ci-cd](), [compliance](), [container-images](), [cybersecurity](), [financial-services](), [new-york-department-of-financial-services](), [nydfs](), [nydfs-500](), [nydfs-500-compliance](), [nydfs-500-for-containers](), [open-source](), [sboms](), [vulnerability]() ### AI overview This article explains NYDFS cybersecurity requirements for financial institutions and describes how Chainguard supports compliance with secure open source artifacts, automated SBOMs, attestations, centralized storage, and vulnerability remediation evidence. ### Source excerpt Learn how Chainguard helps financial institutions meet NYDFS 500 with zero-CVE open source, signed SBOMs, auditable evidence, and vulnerability remediation. ## Chainguard FIPS enters 2026 with OpenSSL 3.1.2 and better CMVP visibility DevFeed: [Chainguard FIPS enters 2026 with OpenSSL 3.1.2 and better CMVP visibility]() Original publisher: [Read original article]() Published: 2026-01-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Docker Hardened Images](), [Cryptography](), [Security, Privacy and Abuse Prevention](), [container images]() Tags: [2026](), [chainguard](), [chainguard-containers](), [chainguard-fips](), [cmvp](), [cmvp-sboms](), [fips](), [fips-140-3](), [fips-compliance](), [fips-containers](), [fips-validation](), [openssl](), [sboms](), [validation]() ### AI overview Chainguard updates its FIPS container images to use the Chainguard FIPS provider for OpenSSL 3.1.2, identified by CMVP certificate #5102. The images now expose CMVP and entropy certification numbers through SBOM packages, while future OpenSSL 3.4 and 3.6 upgrades remain under coordination and review with NIST. ### Source excerpt We updated our FIPS container images with OpenSSL 3.1.2 (CMVP #5102), clearer CMVP visibility in SBOMs, and a roadmap for upcoming FIPS 140-3 cryptography. ## Anchore Enterprise now validates Chainguard Libraries: prevent 98% of Python malware and eliminate high-severity CVE toil DevFeed: [Anchore Enterprise now validates Chainguard Libraries: prevent 98% of Python malware and eliminate high-severity CVE toil]() Original publisher: [Read original article]() Published: 2025-12-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [Python](), [supply-chain-security](), [Malware](), [Open Source]() Tags: [anchore](), [anchore-chainguard](), [anchore-chainguard-partnership](), [anchore-enterprise](), [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-python](), [dependencies](), [malware](), [provenance](), [python](), [sboms](), [slsa](), [supply-chain](), [supply-chain-security]() ### AI overview Anchore Enterprise now supports scanning and validating Chainguard Libraries for Python. The integration combines Anchore's supply-chain security enforcement with Python libraries built from source in a tamper-proof, SLSA L2-certified environment with provenance and signed SBOMs, aiming to prevent malware introduced during build or distribution and reduce high-severity CVE remediation effort. ### Source excerpt Customers can now leverage Anchore Enterprise's scanning capabilities for Chainguard Libraries for Python. ## Chainguard + Booz Allen: Delivering Trusted Open-Source Software to U.S. Government Agencies DevFeed: [Chainguard + Booz Allen: Delivering Trusted Open-Source Software to U.S. Government Agencies]() Original publisher: [Read original article]() Published: 2025-10-15T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [container images](), [Containers](), [open-source-security](), [Vulnerabilities](), [Open Source](), [Security]() Tags: [announce](), [ato](), [booz-allen-hamilton](), [chainguard](), [chainguard-booz-partnership](), [chainguard-containers](), [chainguard-dod-partnership](), [chainguard-libraries](), [common-vulnerabilities-and-exposures](), [compliance](), [container-images](), [containers](), [engineering](), [fedramp](), [fips](), [government](), [hardened-containers](), [open-source](), [open-source-software](), [sboms](), [secure-by-default](), [secure-software](), [security](), [stateramp](), [supply-chain](), [vulnerabilities](), [zero-cve-container-images]() ### AI overview Chainguard and Booz Allen announced a partnership to help U.S. government agencies and defense programs secure software supply chains, reduce vulnerabilities, and accelerate compliance. The partnership combines Booz Allen's mission expertise with Chainguard's secure-by-default open-source software, including hardened containers that helped one defense-related program obtain authorization to operate in eight weeks. ### Source excerpt Chainguard and Booz Allen partner to help federal programs eliminate vulnerabilities, save engineering time, and accelerate compliance timelines. ## Meeting the Zero-CVE Mandate: How Chainguard Helps Businesses Ship Secure Software That Customers Trust DevFeed: [Meeting the Zero-CVE Mandate: How Chainguard Helps Businesses Ship Secure Software That Customers Trust]() Original publisher: [Read original article]() Published: 2025-10-06T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Containers](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [chainguard-custom-assembly](), [chainguard-images](), [containers](), [cves](), [provenance](), [sboms](), [secure-software](), [security](), [software-supply-chain-security](), [zero-cves]() ### AI overview The article explains how Chainguard helps businesses meet stricter software security requirements for self-hosted, cloud, packaged-agent, and embedded software. It focuses on zero known CVEs at delivery, verifiable SBOMs, provenance attestations, compatibility with security tooling, and the challenges of open source dependencies and container images. ### Source excerpt Chainguard's zero-CVE containers come with broad compatibility, custom assembly, verifiable provenance and SBOMs, and more to help you ship secure software. ## Avoiding Vendor Lock-in with a Compatible, Migration-Friendly, Transparent Container Distro DevFeed: [Avoiding Vendor Lock-in with a Compatible, Migration-Friendly, Transparent Container Distro]() Original publisher: [Read original article]() Published: 2025-09-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [Linux](), [interoperability](), [migration](), [CI/CD](), [toolchain](), [Open Source]() Tags: [arm](), [chainguard-migration](), [chainguard-os](), [ci-cd](), [compatibility](), [container](), [distro](), [linux](), [migration](), [migration-guide](), [oci](), [open-source](), [sboms](), [supply-chain](), [toolchain](), [vendor-lock-in](), [wolfi](), [x86]() ### AI overview The article explains how to evaluate a Linux distribution for containerized workloads while reducing vendor lock-in. It emphasizes compatibility with existing toolchains and CI/CD workflows, transparent build processes, migration ease, interoperability, and adherence to standards such as OCI, CycloneDX, and SPDX. ### Source excerpt Learn how to evaluate and select the right Linux distribution to satisfy your team's needs, simplify migration, and avoid vendor lock-in. ## Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk DevFeed: [Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk]() Original publisher: [Read original article]() Author: Phoebe Nerdahl Published: 2025-08-07T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [ai security](), [AI Strategy](), [AI Development](), [Security](), [Vulnerabilities](), [AI Platform](), [GitHub](), [Terraform]() Tags: [agentic-ai-security](), [ai](), [ai-adoption](), [ai-infrastructure](), [ai-security](), [awareness](), [blog](), [compliance](), [devops](), [executive](), [github](), [government](), [nist](), [sboms](), [secure-by-design](), [security](), [self-hosted](), [snyk](), [snyk-platform](), [terraform](), [vulnerabilities]() ### AI overview This article explains how Snyk for Government helps federal agencies adopt AI securely through secure-by-design development, continuous vulnerability management, compliance support, automation, and governance. It highlights integrations across developer workflows, FedRAMP authorization, standards-aligned practices, and the Snyk AI Trust Platform. ### Source excerpt Learn how Snyk for Government helps federal agencies meet AI mandates with confidence. Snyk's AI Trust Platform ensures secure-by-design development, compliance, and transparent AI systems. ## Chainguard Starter Images Now Available in Iron Bank: Minimal, Secure, and Reliable DevFeed: [Chainguard Starter Images Now Available in Iron Bank: Minimal, Secure, and Reliable]() Original publisher: [Read original article]() Published: 2025-03-06T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard images](), [supply-chain-security](), [container images](), [Security](), [Vulnerabilities]() Tags: [chainguard](), [chainguard-starter-images](), [container](), [container-images](), [iron-bank](), [sboms](), [secure-by-default](), [secure-software](), [software-supply-chain-security](), [vulnerabilities](), [zero-cve-container-images](), [zero-cves]() ### AI overview Chainguard Starter Images are now available in the Iron Bank image repository. The images are designed to reduce vulnerability findings, simplify VAT remediation, and streamline the path to Authorization to Operate. Chainguard describes them as secure-by-default images built from source with signed and attested artifacts, build-time SBOMs, hardened compiler settings, and reduced attack surfaces. ### Source excerpt Chainguard Starter Images are zero CVE container images that are now available in the Iron Bank image repository. ## NIS2: Understanding key software security requirements DevFeed: [NIS2: Understanding key software security requirements]() Original publisher: [Read original article]() Published: 2025-02-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability management](), [open-source-security](), [supply-chain-security](), [Cybersecurity](), [Critical Infrastructure](), [Development]() Tags: [compliance](), [cve-management](), [cve-reporting](), [energy](), [eu](), [europe](), [infrastructure](), [manufacturing](), [nis2](), [risk-management](), [sboms](), [secure-software](), [software-supply-chain](), [transportation](), [vulnerability-management]() ### AI overview This article explains how the European Union's NIS2 directive expands software security and vulnerability management requirements, shifts accountability to management and boards, and affects organizations operating in the EU. It discusses software supply chain security, open source development, SBOMs, CVE reporting, risk management, and the workload these requirements may create for security and developer teams. ### Source excerpt The European Union's Network and Information Systems 2 is a compliance framework with strict requirements around vulnerability management. ## Creating SBOMs with the Snyk CLI DevFeed: [Creating SBOMs with the Snyk CLI]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2025-02-05T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [open-source-security](), [Security](), [Command-line interface](), [Vulnerabilities](), [Software](), [DevOps]() Tags: [2025](), [acquisition](), [application-security](), [blog](), [cli](), [compliance](), [developer](), [devops](), [devrel](), [java](), [open-source-security](), [sbom](), [sboms](), [security](), [snyk-open-source](), [snyk-platform](), [software-bill-of-materials](), [vulnerabilities]() ### AI overview This article explains software bills of materials (SBOMs), their importance for open source security and compliance, and how the Snyk CLI can help create them. It describes SBOMs as inventories of software components, dependencies, versions, and licensing information, and explains how they help assess vulnerability exposure. ### Source excerpt In this post, we'll delve into what SBOMs are, why they're necessary, and their role in open source security. ## Chainguard Images are the Gold Standard for PCI DSS v4.0 DevFeed: [Chainguard Images are the Gold Standard for PCI DSS v4.0]() Original publisher: [Read original article]() Published: 2025-02-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container-security](), [Containers](), [supply-chain-security](), [vulnerability management]() Tags: [chainguard](), [chainguard-images](), [chainguard-sboms](), [compliance](), [container](), [container-image](), [container-image-compliance](), [container-images](), [container-security](), [containers](), [cryptography](), [financial](), [pci-dss](), [pci-dss-v4-0](), [sboms](), [software-bill-of-materials](), [software-composition-analysis](), [software-supply-chain](), [stig](), [vulnerability](), [vulnerability-management]() ### AI overview The article explains how Chainguard Images can support selected PCI DSS v4.0 container-security controls. It focuses on asset and vulnerability management, hardened images, FIPS cryptography, build-time SBOMs, software supply chain inventory, and continuously updated containers. ### Source excerpt Chainguard Images are designed to make container image compliance for PCI DSS v4.0 easy for any company involved in card transactions. ## Chainguard Images: The Easy Button for FedRAMP DevFeed: [Chainguard Images: The Easy Button for FedRAMP]() Original publisher: [Read original article]() Published: 2025-01-28T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Docker Hardened Images](), [container-security](), [vulnerability management](), [Containers](), [chainguard sboms](), [Security](), [Development]() Tags: [asset-management](), [ato](), [authority-to-operate](), [chainguard](), [chainguard-images](), [compliance](), [container](), [container-image-security](), [cve](), [fedramp](), [hardening](), [sboms](), [sca](), [sdlc](), [vulnerability](), [vulnerability-management]() ### AI overview This article explains how Chainguard Images can simplify and accelerate FedRAMP Authority to Operate compliance for organizations deploying containerized cloud products to federal government customers. It describes secure-by-design containers as helping address asset management, hardening, cryptography, and vulnerability management requirements, and notes Snowflake's achievement of FedRAMP High with Chainguard Images. ### Source excerpt Chainguard Images are designed to make achieving FedRAMP compliance for container images easier. Learn more about how we make vulnerability management simple. [Next page]()