Skip to main content
Image coming soon

MFG3221 Mastering SLSA for Senior Software Supply Chain Practitioners

$199.00
Adding to cart… The item has been added

A tailored course, built for your situation

Mastering SLSA for Senior Software Supply Chain Practitioners

Build verifiable, production-grade software supply chain integrity with confidence and precision

$199 one-time
24-hour access provisioning 30-day money-back guarantee Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Most practitioners are reactive, approving tools after procurement or remediating after audit. You can be the one setting the terms.

The situation this course is for

Without a structured approach to SLSA implementation, even strong teams default to compliance-by-checklist, missing the strategic leverage of being the first call on vendor integrations and new build validations.

Who this is for

Senior software engineers, platform leads, and security architects who operate at the intersection of code integrity, CI/CD governance, and vendor trust frameworks

Who this is not for

Entry-level developers, auditors focused only on checklist compliance, or teams without ownership of build pipeline decisions

What you walk away with

  • Design SLSA Level 3+ compliant build systems from first principles
  • Produce signed, machine-verifiable attestations for any build pipeline
  • Lead vendor onboarding using SLSA-based pedigree assessments
  • Differentiate your team’s offerings with verifiable build integrity claims
  • Position yourself as the internal reference for SLSA adoption roadmaps

The 12 modules (with all 144 chapters)

Module 1. SLSA Fundamentals and Industry Evolution
Understand the origin, design goals, and real-world drivers behind SLSA adoption across cloud-native and enterprise environments.
12 chapters in this module
  1. What SLSA solves that prior frameworks don’t
  2. Key players adopting SLSA today
  3. The role of transparency in modern software trust
  4. SLSA vs. SPDX vs. SBOM: when to use which
  5. How NIST SSDF aligns with SLSA principles
  6. The Google and OpenSSF origins
  7. SLSA’s four levels explained concretely
  8. When Level 1 is enough, and when it’s not
  9. The cost of false positives in attestation
  10. Real-world breach paths SLSA prevents
  11. How regulators are referencing SLSA
  12. Common misconceptions about implementation cost
Module 2. SLSA Level 1 Implementation
Implement baseline SLSA compliance with structured build metadata and artifact provenance.
12 chapters in this module
  1. Defining build platform identity
  2. Capturing start and end time reliably
  3. Recording build inputs with integrity
  4. Tracking build environment details
  5. Storing metadata in provenance format
  6. Using GitHub Actions for Level 1
  7. Validating source repository origin
  8. Signing metadata with GitHub OIDC
  9. Storing attestations in public repositories
  10. Auditing for consistency across runs
  11. Common failure modes at Level 1
  12. Automating validation checks
Module 3. SLSA Level 2 Build Platform Hardening
Upgrade from basic to repeatable builds with hosted, verifiable infrastructure.
12 chapters in this module
  1. Why hosted platforms are required for Level 2
  2. Choosing between Cloud Build, CodeBuild, Actions
  3. Eliminating local execution paths
  4. Reproducibility requirements defined
  5. Container image build constraints
  6. Using Rekor for transparency logs
  7. Verifying build entry in transparency log
  8. Signing build outputs with Fulcio
  9. Configuring OIDC trust chains
  10. Validating platform compliance automatically
  11. Integrating with CI/CD pipelines
  12. Common gaps in Level 2 implementations
Module 4. SLSA Level 3 Reproducible Builds
Achieve full build reproducibility and protect against non-deterministic outputs.
12 chapters in this module
  1. What makes a build reproducible
  2. Standardizing build environments
  3. Eliminating timestamps in outputs
  4. Deterministic compilation techniques
  5. Container build layer ordering
  6. Hashing inputs with canonical order
  7. Using source maps effectively
  8. Validating output hashes across runs
  9. Detecting drift in build environments
  10. Handling dependencies with lockfiles
  11. Reproducing builds in isolated sandboxes
  12. Documenting reproducibility for audit
Module 5. SLSA Level 4 Incremental Verification
Implement continuous verification and two-person review for critical builds.
12 chapters in this module
  1. Defining criticality thresholds for builds
  2. Implementing two-person approval workflows
  3. Tracking reviewer attestations
  4. Using policy engines for automated checks
  5. Integrating with code review systems
  6. Logging approvals in transparency logs
  7. Preventing rollback to weaker levels
  8. Enforcing build policy across teams
  9. Auditing verification history
  10. Scaling Level 4 across large orgs
  11. Trade-offs between speed and assurance
  12. Real-world examples from Google and Microsoft
Module 6. Attestation and Signature Management
Generate, store, and verify cryptographic attestations for builds and releases.
12 chapters in this module
  1. Understanding SLSA attestation format
  2. Signing with Sigstore and Fulcio
  3. Storing signatures in transparency logs
  4. Verifying signatures automatically
  5. Using cosign for container signing
  6. Integrating with image registries
  7. Keyless signing with OIDC
  8. Handling certificate rotation
  9. Multi-party signing workflows
  10. Attestation metadata schema
  11. Common signature validation errors
  12. Best practices for long-term verification
Module 7. SBOM Integration with SLSA
Combine SLSA attestations with comprehensive SBOMs for full transparency.
12 chapters in this module
  1. Generating SBOMs from build outputs
  2. Linking SBOMs to SLSA attestations
  3. Using Syft and Grype together
  4. Validating SBOM completeness
  5. Publishing SBOMs with provenance
  6. Consuming SBOMs in downstream services
  7. Automating SBOM generation in CI
  8. Handling license compliance via SBOM
  9. Detecting vulnerable dependencies
  10. SBOM formats: SPDX vs. CycloneDX
  11. Storing SBOMs in transparency logs
  12. Making SBOMs human-readable
Module 8. Policy Enforcement and Automation
Enforce SLSA compliance across teams and pipelines with automated policy engines.
12 chapters in this module
  1. Writing policy rules for SLSA levels
  2. Using CUE for policy definition
  3. Integrating with OPA/Gatekeeper
  4. Blocking non-compliant builds
  5. Generating policy violation reports
  6. Onboarding teams to policy standards
  7. Exempting legacy systems appropriately
  8. Auditing policy compliance over time
  9. Scaling policy enforcement across clouds
  10. Handling false positives gracefully
  11. Policy versioning and review
  12. Integrating with security dashboards
Module 9. Vendor and Third-Party Integration
Extend SLSA validation to external partners and open-source dependencies.
12 chapters in this module
  1. Assessing vendor SLSA compliance
  2. Requesting attestations from suppliers
  3. Validating third-party build outputs
  4. Handling missing or partial attestations
  5. Using transparency logs for vendor checks
  6. Integrating with software bills of materials
  7. Creating vendor onboarding checklists
  8. Negotiating SLSA requirements in contracts
  9. Benchmarking vendor maturity levels
  10. Managing exceptions and waivers
  11. Automating vendor attestation reviews
  12. Publishing supplier trust reports
Module 10. Incident Response with SLSA
Use SLSA data to accelerate breach investigation and remediation.
12 chapters in this module
  1. Identifying compromised builds quickly
  2. Tracing artifact provenance during incidents
  3. Validating clean rebuilds post-breach
  4. Using transparency logs for forensic timelines
  5. Automating incident playbooks with attestations
  6. Communicating rebuild status externally
  7. Rebuilding trust with customers
  8. Coordinating with security teams
  9. Documenting remediation steps
  10. Auditing rebuild integrity
  11. Integrating with SIEM systems
  12. Lessons from real-world breaches
Module 11. SLSA in Regulated Environments
Apply SLSA principles in compliance-heavy industries like finance and healthcare.
12 chapters in this module
  1. Mapping SLSA to SOC 2 requirements
  2. Using SLSA for HIPAA compliance
  3. Integrating with ISO 27001 frameworks
  4. SLSA and GDPR data provenance
  5. Meeting financial audit expectations
  6. Documenting for external auditors
  7. Handling jurisdictional data rules
  8. SLSA in government contracts
  9. Aligning with NIST CSF
  10. Preparing for DORA compliance
  11. Regulator-facing documentation templates
  12. Case study: SLSA in a bank
Module 12. Leading SLSA Adoption Across Teams
Drive organization-wide SLSA implementation with measurable impact.
12 chapters in this module
  1. Building internal champions
  2. Creating phased rollout plans
  3. Measuring adoption progress
  4. Training engineers on best practices
  5. Integrating with developer onboarding
  6. Reducing friction in daily workflows
  7. Celebrating early wins
  8. Scaling tooling across orgs
  9. Maintaining long-term compliance
  10. Sharing success externally
  11. Positioning as a career accelerator
  12. The future of software supply chain standards

How this maps to your situation

  • When starting a new build system
  • Before onboarding a critical vendor
  • After a security audit finding
  • When expanding to regulated markets

Before vs. after

Before
Reactive engagement with supply chain standards, dependent on external teams for attestation and verification.
After
Proactive leadership in SLSA adoption, with authority to define and validate build integrity across projects and vendors.

What's included with your purchase

  • 12 modules with 12 chapters each (144 chapters)
  • Downloadable templates and worked examples for every module
  • Hand-built implementation playbook delivered alongside course access
  • 30-day money-back guarantee

Delivery and format

  • Course and learning environment access provisioned within 24 hours of purchase
  • Hand-built implementation playbook delivered alongside course access

Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.

Time investment: Approximately 3 hours per module, designed to fit around real project timelines.

If nothing changes
Teams without structured SLSA practices will be excluded from high-trust, high-budget initiatives, especially in regulated or M&A contexts where code pedigree is non-negotiable.

How this compares to the alternatives

Unlike generic security courses, this program delivers actionable, step-by-step SLSA implementation guidance with real-world templates and direct applicability to production environments.

Frequently asked

Is this course only for security teams?
No. It's designed for engineers, platform leads, and architects who own build pipelines and vendor integrations.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Do I need prior experience with SLSA?
No. The course starts from first principles and builds to advanced implementation.
$199 one-time. Approximately 3 hours per module, designed to fit around real project timelines..

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

30-day money-back guarantee· 144 chapters· Hand-built playbook included· Account access within 24 hours
!