CNCF Security Projects#

CNCF security work spans two related tracks: TAG Security (the Technical Advisory Group that produces security assessments, publications, and tooling for the ecosystem) and project-level security requirements baked into the CNCF maturity lifecycle. Both tracks are tightly coupled — a project's security posture is formally evaluated as part of moving through Sandbox → Incubating → Graduated.

TAG Security facilitates collaboration to reduce attack and compromise risk across the cloud native ecosystem, with focus areas including system security architectures, a common security lexicon, reusable templates and libraries, and heuristics/models 1. It operates working groups in Automated Governance, Compliance, Security Assessments, and Software Supply Chain 2.

Key security maturity requirements in the CNCF project lifecycle 3:

• Incubating: security self-assessment + OpenSSF Best Practices badge required.
• Graduated: all incubation requirements + a third-party security audit; maintainers from ≥2 independent organizations.

TAG Security Security Assessments (TSSA)#

The TSSA process provides the TOC with structured security information about CNCF projects. All artifacts live in community/assessments/projects/ 4. The guide for producing them is at community/assessments/guide/README.md 5.

There are two assessment paths:

Abbreviated Assessment (Sandbox / early-stage projects)#

For earlier-stage projects that want initial feedback without a full reviewer-led process 6:

1. Self-assessment — project documents its threat model and security design using the self-assessment template.
2. Presentation issue — project lead opens a presentation issue.
3. Present to TAG — present the self-assessment at a TAG Security meeting for rough feedback.
4. Submit PR — add the self-assessment to assessments/projects/<project-name>/.

Joint Assessment (Incubating / Graduated)#

A more comprehensive, reviewer-led process for mature projects 7:

1. Tracking issue — opened via the joint assessment template; can be initiated by the project or TOC liaison.
2. Self-assessment — project creates a Google Doc self-assessment; TAG Security assigns a lead reviewer plus ≥2 additional reviewers.
3. Conflict of interest check — all reviewers declare hard and soft conflicts of interest before reviewing 8.
4. Clarifying questions — lead reviewer validates completeness and asks clarifying questions prior to the 3-week assessment window 9.
5. Security assessment — reviewers examine the self-assessment, repo, and docs; questions and comments are resolved collaboratively; the assessment team drafts a joint assessment with final edit discretion 10.
6. Presentation — project presents at a TAG meeting; assessment team summarizes recommendations.
7. Final artifacts — both the self-assessment and joint assessment are committed under assessments/projects/<project-name>/.
8. Post-assessment survey — completed by reviewers and the project lead 11.

Note: Some self-assessments were created by "Security Pals" — external parties who draft assessments from project documentation, which may not have been reviewed by the project team 12.

Third-Party Security Audits#

Security audits (distinct from TAG Security's self/joint assessments) are a hard requirement for Graduated projects 3. They are typically CNCF-sponsored or project-sponsored engagements with external security firms. When reviewing graduation applications, the TOC sponsor confirms that all critical and high findings from audits have been resolved; remaining findings should be tracked 13.

Examples of graduated projects with audits include Falco 14, Flux 15, Open Policy Agent 16, TUF 17, Crossplane 18, and Dapr 19.

The canonical listing of audits for all CNCF projects is maintained in the TOC repository at docs/projects.md — Project Security Audits section 20.

How to Participate in TAG Security#

TAG Security welcomes new contributors. The primary entry points are 21:

• Slack: Join #tag-security in the CNCF Slack to introduce yourself. For governance discussions use #tag-security-governance; for triage use #tag-security-triage .
• Meetings: Attend regular TAG Security meetings — meeting notes and schedule are linked from the TAG Security README 23.
• Issues: Browse open issues and look for "good first issue" labels; comment to express interest before picking up work 21.
• Proposals: Anyone can raise a suggestion or proposal to start new projects. Proposals require a volunteer project lead; suggestions do not 24. The full proposal lifecycle — from idea to active project — is described in governance/process.md 25.
• Pull Requests: PRs require at least one qualified review and should stay open ≥24 hours; review the CONTRIBUTING.md before your first contribution 26.
• Presentations: Submit a presentation issue to present your work or project to the TAG 27.

Key References#