Sonatype Lifecycle Policy

Interactive challenges with Lifecycle deployment, policies, and SDLC integration
The Sonatype Lifecycle Policy Workshop introduces the core concepts of Sonatype Lifecycle policies that drive guidance and enforcement throughout the software lifecycle. This one-day workshop focuses on defining and configuring the rules for policy use and learning best practices for continuous policy-based component governance.

Key accomplishments:

• Understand key policy creation and management concepts
• Test the policy to ensure actionable findings
• Develop strategies to refine policies over time
• Learn about approaches to ongoing enforcement

22.6%
Sonatype Lifecycle and SCA tools increase successful remediation rates
Sonatype Lifecycle improves vulnerability management and effectiveness

30%
Build-safe components in Sonatype Lifecycle are directly tied to policy-driven automation
Sonatype Lifecycle improves MTTR (mean time to remediate) by 30%

6x
Faster policy-based automation due to Sonatype Lifecycle and SCA tools
Sonatype Lifecycle improves customer release velocity by ~6x on average

Recommended for:

Ideal for any new user that is involved in policy creation and management including open source review board members, application security staff, architects, and the legal/compliance team.

Register Cost:

Multiple options are available and prices may vary. Please contact us at success@sonatype.com for information about pricing or how to register for a workshop.

Sonatype Lifecycle Policy Outline

NOTE: Requires the ability to run screen-sharing software (Zoom) and complete exercises. Maximum of 10 learners per class.

It’s not just Sonatype Lifecycle — it's mastering the art of secure, efficient software delivery

MODULE 1

Introduction to Sonatype Lifecycle

• Discussing the risk and magnitude of OSS consumption
• Building a good component practice
• Finding your place in the Sonatype Lifecycle deployment model
• The role of Lifecycle policy

MODULE 2

IDE installation and configuration

• Configuring Sonatype Lifecycle to represent your organizational structure
• Observing policy inheritance
• Best practices for setting up organizations and applications

MODULE 3

Anatomy of a policy

• Deep dive into features/functions of policies
• Categorizing and constructing policy
• Using labels, license threat groups, and security
• Enforcing component consumption

MODULE 4

Using Sonatype default policies

• Overview of Security, License, Architecture, and Component policies
• Using Sonatype Lifecycle policies to communicate open source risk tolerance
• Managing policies

MODULE 5

Policy verification

• Validating policy based on organizational risk tolerance
• Verifying the accuracy of policy elements

MODULE 6

Policy triage

• Ensuring issues are actionable
• Adopting policy-specific, triage workflows
• Evaluating policy exceptions

MODULE 7

Reporting

MODULE 8

• Discussing various types of reports, such as trending reports
• Socializing expectations
• Bridging the developer gap

About Sonatype Workshops:

• Discussing scanning philosophies for component selection and governance

Sonatype Workshops jump-start your team's momentum and support essential changes. You'll gain strong foundational skills, expert-led training for every department, and curricula covering everything from Maven and Nexus Repository basics to advanced Sonatype Lifecycle.

Whether you prefer public classes, onsite sessions, or self-paced learning, we can help, including custom courses tailored to your needs. Learn more at sonatype.com/learning-and-development.

Sonatype is the software supply chain management company. We enable organizations to innovate faster in a highly competitive market. Our industry-leading platform empowers engineers to develop software fearlessly and focus on building products that power businesses. Sonatype researchers have analyzed more than 120 million open source components – 40x more than its competitors – and the Sonatype platform has automatically blocked over 115,000 malicious components from attacking software development pipelines. Enabling high-quality, secure software helps organizations meet their business needs and those of their customers and partners. More than 2,000 organizations, including 70% of the Fortune 100 and 15 million software developers, rely on our tools and guidance to be ambitious, move fast and do it securely. To learn more about Sonatype, please visit www.sonatype.com.