Engagement 03
First Ten Controls
Ten controls on the pipeline you already have, none of them blocking on day one.
The situation
Hardening programs stall for a reason that has little to do with security. They arrive as a list of gates, a gate blocks a release during an incident, somebody disables it at 2am, and nobody re-enables it. The controls were right and the rollout was wrong.
These ten are chosen to run in warn mode first, on the pipeline you have, with a written way back down. Nothing blocks on day one. What a board sees inside a quarter is movement with evidence under it.
This is you if
- You cannot re-platform this year but you can harden what is running.
- Your board wants auditable progress and you need something that shows movement inside a quarter.
- A previous security gate was rolled back during an incident and never re-enabled.
How it runs
- Weeks 1–2
Pick the repositories that matter
Not all of them. The ones that build what you ship, which is almost always a far shorter list than the organization's repository count suggests.
- Weeks 2–4
Land the controls in warn mode
Branch protection, pinned actions and dependencies, federated identity in CI, secret scanning with push protection. Everything reports and nothing blocks.
- Weeks 4–6
Enforce, with a way back down
Enforcement moves repository by repository, each with a documented exception process. A gate nobody can get past during an incident is a gate that gets deleted.
What you are left holding
- Branch protection, code owners and signed commits on the repositories that matter
- Actions and dependencies pinned to digests, with lockfile discipline enforced
- Federated identity in CI in place of long-lived cloud keys
- Secret scanning with push protection, and reachability-filtered dependency alerts
- A written exception process, because a gate with no way back is a gate somebody disables
What we need from you
- Administrator rights on the repositories in scope, or an engineer who has them working alongside us.
- Your cloud identity provider, so long-lived CI keys can be replaced with federated identity.
- Agreement up front on who may grant an exception, and for how long.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not a platform migration. These run on the CI you already have.
- Not ten controls read off a framework. They are chosen from what your pipeline is missing, and ten is a ceiling rather than a quota.
What we can already show
Reachability filtering took developer-facing dependency alerts from 100% to 9% on our own codebase.
Why people call about this one
Your customers are asking first
Enterprise buyers and regulators now require SBOMs, provenance and SSDF or CMMC evidence from suppliers. The questionnaire arrives attached to a contract that is otherwise ready to sign.
The demand lands hardest on mid-size vendors and defense subcontractors, who are least equipped to answer it
The shape of it
- Shape
- Four to six weeks, fixed scope
- Usually funded by
- Engineering · CISO
- Often leads to
- Supply Chain Modernization