Standard
Container and Image Security Standard
This standard defines the security controls applied to container images, container runtimes, image registries, and the supply chain that produces and distributes images. It covers Linux containers (Docker, OCI), Windows containers, Kubernetes and equivalent orchestrators, serverless container platforms, and the secure-build pipelines that produce images.
- Type
- Standard
- Version
- 1.0.4
- Date
- 2026-09-24
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Developer Security
- Review frequency
- Annual and upon material change to container platforms, runtime, or supply-chain practice
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Image build
- 4. Image registry
- 5. Runtime
- 6. Orchestrator security
- 7. Developer workflow
- 8. Serverless container platforms
- 9. Supply-chain integrity
- 10. Vulnerability management
- 11. Data handling in containers
- 12. Incident response readiness
- 13. Operating expectations
- 14. Framework alignment
- 15. Limitations
Frameworks it maps to
- NIST SP 800-190
- NIST SP 800-204 series
- CIS Benchmarks
- CNCF Cloud Native Security Whitepaper v2
- SLSA
- Sigstore
- CycloneDX, SPDX
- OWASP Container Security Verification Standard
- Kubernetes Pod Security Standards
- MITRE ATT&CK (Containers)
- ISO/IEC 27001:2022
Related documents
- Secure Development and Engineering Policydev-security
- Developer Security Requirementsdev-security
- DevOps Security Requirementsdev-security
- Software Composition Analysis Standarddev-security
- Production Security Requirementsoperations
- Cloud Security Configuration Baselineoperations
- Patch Management Procedureoperations
- Logging and Monitoring Standardsecurity
- Cryptographic Key Lifecycle Management Frameworksecurity
- Software Bill of Materials Registersupply-chain
Next
All Documents