A tailored course, built for your situation
Mastering SLSA for Software Supply Chain Governance Practitioners
Build verifiable, enterprise-grade software integrity with SLSA frameworks that scale across distributed toolchains
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Fragmented build processes leading to inconsistent audit trails
The situation this course is for
As software supply chain regulations tighten, teams struggle to prove build integrity without manual, error-prone processes. Without standardized provenance, even compliant pipelines face scrutiny during audits.
Who this is for
Software supply chain governance professionals in tech-first enterprises implementing SLSA, SBOM, or zero-trust build standards
Who this is not for
Developers focused solely on application code, not build infrastructure or compliance traceability
What you walk away with
- Generate SLSA Level 3+ compliant provenance for any CI/CD pipeline
- Map build environments to SLSA attestation requirements with confidence
- Lead internal reviews on software integrity with reference-quality documentation
- Translate technical build controls into audit-ready narratives
- Serve as the go-to resolver for cross-functional SLSA escalations
The 12 modules (with all 144 chapters)
Module 1. Understanding SLSA and Its Role in Modern Software Supply Chains
Explore the origins, objectives, and real-world impact of SLSA in securing software from source to production. Learn how SLSA fits within broader supply chain integrity initiatives.
12 chapters in this module
- What SLSA aims to solve
- Key stakeholders in SLSA adoption
- SLSA vs regulatory expectations
- The four SLSA levels explained
- When to apply SLSA in the SDLC
- Integration with DevOps culture
- Common misconceptions about SLSA
- SLSA and zero-trust principles
- Relation to NIST SSDF
- Role of automation in SLSA
- Audit expectations by level
- Real-world SLSA implementations
Module 2. Establishing Foundational Build Integrity
Lay the groundwork for repeatable, secure builds by defining build environments, dependencies, and integrity checks required for SLSA compliance.
12 chapters in this module
- Defining a hermetic build
- Controlling build inputs
- Isolating build environments
- Versioning build tools
- Managing dependency chains
- Secure credential handling
- Build metadata standards
- Immutable build logs
- Build worker trust model
- Container integrity checks
- Language-specific build risks
- Baseline for Level 1
Module 3. Generating and Structuring Provenance
Learn how to generate authenticated, machine-readable records of how software was built, a core requirement for SLSA Level 2+.
12 chapters in this module
- What constitutes provenance
- In-toto attestation format
- Signing build outputs
- Timestamping with RFC 3161
- Linking source to build config
- Including environment details
- Metadata schema design
- Automating provenance capture
- Validating third-party provenance
- Storing provenance securely
- Human-readable summaries
- Provenance lifecycle management
Module 4. Implementing SLSA Level 2 Requirements
Achieve SLSA Level 2 by ensuring two-party control and authenticated provenance, moving beyond basic build integrity.
12 chapters in this module
- Two-person review patterns
- Separation of duties in CI
- Approval workflows for builds
- Verified merge request process
- Provenance signing keys
- Key rotation policies
- Audit trail completeness
- Toolchain access logs
- Immutable storage for attestations
- Verifiable timestamps
- Evidence retention period
- Internal validation checklist
Module 5. Achieving SLSA Level 3 and Beyond
Reach higher assurance by eliminating nondeterminism and hardening the build platform itself.
12 chapters in this module
- Deterministic build definition
- Removing build time variation
- Container base image control
- Minimal build environments
- Hardened worker security
- Network egress controls
- Immutable infrastructure
- Signed build environment images
- Remote attestation use cases
- Zero-standing privileges in CI
- Cross-repo build isolation
- Path to Level 4
Module 6. Integrating SLSA with CI/CD Platforms
Adapt SLSA requirements to real-world pipelines in Jenkins, GitHub Actions, GitLab CI, and enterprise environments.
12 chapters in this module
- CI platform trust model
- GitHub Actions provenance
- GitLab CI integration
- Jenkins attestation plugin
- Argo Workflows setup
- Tekton with SLSA
- Custom pipeline instrumentation
- Monitoring build attestations
- Handling pipeline failures
- Rebuild policies
- Multi-stage verification
- Pipeline drift detection
Module 7. Validating and Verifying SLSA Attestations
Ensure your SLSA implementation meets verification standards and can withstand audit scrutiny.
12 chapters in this module
- Using slsa-verifier tool
- Policy-based verification
- Keyless signing validation
- Fulcio and Rekor integration
- Checking provenance format
- Signature chain validation
- Timestamp authority checks
- Automated compliance gates
- Manual review protocols
- Third-party validation readiness
- Common validation failures
- Audit walkthrough preparation
Module 8. SLSA in Regulated Environments
Apply SLSA in industries with strict compliance requirements such as finance, healthcare, and government.
12 chapters in this module
- Mapping SLSA to SOX controls
- FDA software validation overlap
- NIST CSF alignment
- HIPAA build environment rules
- Financial sector expectations
- Government procurement standards
- Export control implications
- Third-party vendor assessments
- Supply chain due diligence
- Internal audit coordination
- Regulator-facing documentation
- Cross-border data flows
Module 9. Communicating SLSA Across Stakeholders
Translate technical controls into business value for security, legal, compliance, and executive teams.
12 chapters in this module
- Executive summary templates
- Risk narrative for leadership
- Legal team alignment
- Security team collaboration
- Developer onboarding plan
- Audit team support
- Vendor communication playbook
- Incident response integration
- Training for non-technical roles
- Metrics for progress tracking
- Roadmap presentation
- FAQ for internal rollout
Module 10. Scaling SLSA Across Organizations
Extend SLSA practices consistently across teams, repos, and geographies without sacrificing agility.
12 chapters in this module
- Centralized policy enforcement
- Template-based adoption
- Automated onboarding flow
- Cross-team governance model
- Standardized tooling
- Version control strategy
- Monitoring compliance at scale
- Feedback loops for improvement
- Documentation standards
- Change management process
- Leadership alignment
- Success measurement
Module 11. Advanced SLSA Patterns
Explore cutting-edge implementations including keyless signing, reproducible builds, and automated policy enforcement.
12 chapters in this module
- Sigstore keyless signing
- Fulcio identity integration
- Rekor transparency log use
- Cosign for attestations
- Bazel and SLSA
- Reproducible Java builds
- Go build determinism
- Python packaging challenges
- Container rebuild verification
- Binary diffing for validation
- Automated compliance bots
- Policy as code frameworks
Module 12. SLSA Maturity and Future Roadmap
Assess your organization's SLSA maturity and plan for future enhancements and integrations.
12 chapters in this module
- SLSA maturity model
- Self-assessment tool
- Gap analysis method
- Prioritization framework
- Roadmap planning
- Emerging standards overlap
- DORA metrics correlation
- Vendor ecosystem trends
- OpenSSF collaboration
- Contribution opportunities
- Training program design
- Long-term sustainability
How this maps to your situation
- After first audit findings on build provenance
- When onboarding regulated clients
- Before scaling CI/CD pipeline usage
- During vendor security assessments
Before vs. after
Before
Manually reconstructing build histories for audits with inconsistent toolchain support
After
Automatically generating SLSA-compliant provenance with audit-ready documentation
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters total)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, with self-paced access and lifetime updates.
If nothing changes
Without standardized build provenance, teams face increased audit friction, higher remediation costs, and reputational risk from software supply chain incidents.
How this compares to the alternatives
Unlike generic DevSecOps courses, this program delivers SLSA-specific implementation patterns used by leading tech firms, with direct applicability to regulated software delivery.
Frequently asked
Is this course only for developers?
No, it's designed for governance, security, and operations practitioners who need to validate and standardize build integrity, not just those writing code.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Does this cover SBOM integration?
Yes, module 11 includes SBOM generation and correlation with SLSA provenance for full traceability.
$199 one-time. Approximately 3 hours per module, with self-paced access and lifetime updates..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours