Skip to content
RockPointCyber

Secure Pipeline Builder

A pipeline is an argument about what you will not ship.

Open one of our reference designs and read it stage by stage: every gate, what it blocks, the framework controls it lets you evidence, and the attack techniques it closes. Then follow any control to the products that provide it.

The field, and the two places it narrows

Supply chain security is not one pipeline. It is seven streams of work running across eight lifecycle phases, and 43 of the 56 places where those cross hold controls. Everything your pipeline produces passes through the same two boundaries on the way in and on the way out.

01Plan
02Code
03Build
04Test
05Release
06Deploy
07Operate
08Monitor
GOVDecide
11Governance and assurance at Plan: 11 controls
Governance and assurance at Code: nothing, by the nature of the work
2Governance and assurance at Build: 2 controls
Governance and assurance at Test: nothing, by the nature of the work
2Governance and assurance at Release: 2 controls
1Governance and assurance at Deploy: 1 control
5Governance and assurance at Operate: 5 controls
4Governance and assurance at Monitor: 4 controls
SUPAdmit
4Open source and third-party supply at Plan: 4 controls
11Open source and third-party supply at Code: 11 controls
20Open source and third-party supply at Build: 20 controls
2Open source and third-party supply at Test: 2 controls
6Open source and third-party supply at Release: 6 controls
1Open source and third-party supply at Deploy: 1 control
10Open source and third-party supply at Operate: 10 controls
8Open source and third-party supply at Monitor: 8 controls
DEVAuthor
8Design and development at Plan: 8 controls
22Design and development at Code: 22 controls
5Design and development at Build: 5 controls
3Design and development at Test: 3 controls
2Design and development at Release: 2 controls
Design and development at Deploy: nothing, by the nature of the work
4Design and development at Operate: 4 controls
3Design and development at Monitor: 3 controls
DELProduce
2Build and delivery at Plan: 2 controls
10Build and delivery at Code: 10 controls
39Build and delivery at Build: 39 controls
1Build and delivery at Test: 1 control
18Build and delivery at Release: 18 controls
13Build and delivery at Deploy: 13 controls
13Build and delivery at Operate: 13 controls
4Build and delivery at Monitor: 4 controls
VERProve
1Testing and validation at Plan: 1 control
2Testing and validation at Code: 2 controls
Testing and validation at Build: nothing, by the nature of the work
10Testing and validation at Test: 10 controls
Testing and validation at Release: nothing, by the nature of the work
1Testing and validation at Deploy: 1 control
9Testing and validation at Operate: 9 controls
Testing and validation at Monitor: nothing, by the nature of the work
OPSRun
Runtime and platform at Plan: nothing, by the nature of the work
Runtime and platform at Code: nothing, by the nature of the work
1Runtime and platform at Build: 1 control
Runtime and platform at Test: nothing, by the nature of the work
Runtime and platform at Release: nothing, by the nature of the work
5Runtime and platform at Deploy: 5 controls
35Runtime and platform at Operate: 35 controls
2Runtime and platform at Monitor: 2 controls
OBSWatch
3Detection and continuous observation at Plan: 3 controls
1Detection and continuous observation at Code: 1 control
Detection and continuous observation at Build: nothing, by the nature of the work
1Detection and continuous observation at Test: 1 control
Detection and continuous observation at Release: nothing, by the nature of the work
Detection and continuous observation at Deploy: nothing, by the nature of the work
7Detection and continuous observation at Operate: 7 controls
21Detection and continuous observation at Monitor: 21 controls
GOV Governance and assurance
The stream that decides what blocks, and proves it blocked.
SUP Open source and third-party supply
Everything you did not write, arriving faster than you can review it.
DEV Design and development
Where the cost of a fix is lowest and the attention is shortest.
DEL Build and delivery
The machine that makes the thing, and the largest single target in the chain.
VER Testing and validation
The stream that finds out whether any of the others worked.
OPS Runtime and platform
The last place to stop something, and the most expensive.
OBS Detection and continuous observation
The only stream whose answer changes while nothing else does.

Each block is how many controls the field places in that stream at that phase — 333 placements across 43 of 56 cells. A hairline means the stream has no control that can act at that phase, which is the nature of the work rather than a gap: runtime protection cannot run before a workload exists.

The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.

The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.

  • IN · on the way in · at build

    Intake

    Do you know what came in, and could you have stopped it?

    Everything entering the pipeline that nobody in the organization wrote: open-source packages, base images, models, datasets and vendor code.

    Defaults open A component nobody reviewed executes with the credentials of whoever installed it.

    Closed by DEPS · SBOM · REGISTRY · VENDOR · AI

  • OUT · on the way out · at release

    Release

    Can you prove what is leaving was built from what you reviewed?

    Everything leaving the pipeline: container images, binaries, packages, infrastructure definitions and the attestations that travel with them.

    Defaults open An artifact with no provenance is admitted because nothing downstream was configured to require one.

    Closed by CICD · BUILD · REGISTRY · CONTAINER · IAC

Reference pipelines

5 designs we have modeled end to end. Each one is a position, not a menu — the sovereign supply chain enforces both choke points, the hardened container path trades breadth for depth at the image boundary.

Or compose your own

Choose the capability domains you care about and a maturity ceiling, and the graph places every matching control into the lifecycle phase it belongs to — then tells you which frameworks that selection evidences and which modeled attacks it leaves open. Nothing is saved; the selection lives in the URL.

Compose a pipelineOr load the complete modern pipeline

The complete template starts you with every control the graph holds, at every maturity level, in every stream — nothing pre-removed. It is the long way round on purpose: deciding a control is out of scope is a decision worth making once, deliberately, rather than one made for you by a template that quietly left it out.