## SONATYPE EDUCATION

# Nexus Lifecycle Champion Workshop

The Nexus Lifecycle, formerly Component Lifecycle Management (CLM), Champion Workshop provides an in-depth review of deployment strategies, policy maintenance, risk mitigation, and socializing adoption. The one-day workshop is strategic, including determining how to deploy and ensure your teams adopt Nexus Lifecycle, enforce policies and resolve violations, as well as understand reporting on risks.

»» Identify deployment strategy

## Key Accomplishments:

»» Review approaches to ongoing enforcement

»» Develop proficiencies in policy violation resolution

»» Understand reporting on application and enterprise-wide risk

»» Develop a strategy for socializing Nexus Lifecycle adoption

## Recommended for:

Ideal for anyone involved in policy creation and management. This typically includes open source review board members, application security staff, architects, and the legal/compliance team.

## Related Product:

nexus lifecycle

(formerly Component Lifecycle Management—CLM)

## Cost:

Multiple options are available and prices may vary. Please contact us at success@sonatype.com.

**Visit sonatype.com/training for more details.**

---

# Nexus Lifecycle Champion Workshop Outline

## MODULE I

**Review Policy Violations**

»» Confirm efficacy of existing policies

»» Adjust policies to reflect new requirements as necessary

## MODULE II

**Security Defect**  
**Remediation Workflow**

»» Design triage and remediation workflows to handle each type of security issue

»» Understand the types of security issues

»» Determine when to research a security issue rather than waive a policy

## MODULE III

## License Threat

## Remediation Workflow

»» Understand how license threat level is assessed

»» Design triage and remediation workflows to address license risk

»» Determine when to accept license risk versus selecting a less risky component

## MODULE IV

## Component Triage

## Beyond Policy  
»» Design triage and remediation

»» Handle “similar match” findings
»» Identify proprietary components
»» Claim unknown components

## MODULE V

## Targeted Reporting

»» Discuss report sources (command line, server)

»» Discuss roll-up dashboard report and metrics

## Summary  
»» Verify when appropriate people are notified of security and license violations

## MODULE VI

**Long Term Expectations &**  
**Adoption Plans**

»» Encourage—don’t force—developer use of Nexus Lifecycle

»» Balance needs of and communicate with Development, Operations, and Security

»» Maintain a scalable Nexus Lifecycle deployment

## MODULE VII

## Beyond Policy

»» Minimize “noise” while maintaining risk tolerance threshold

»» Consider good component practice even in the absence of a policy violation

»» Define communications process for tough issues

## MODULE VIII

**Summary**

»» Review any outstanding questions

»» Develop plan to leverage Sonatype resources for success

## About

## Sonatype Services

## Sonatype resources for success

If you’re looking for that edge to get your team excited and committed to the change you desire, Sonatype Services are the essential piece you’ve been looking for. With Sonatype Services, you will:

»» Start your users off with a solid foundation of skills
»» Make each department and team a success with expert training  
!  
»» Increase your knowledge with thoughtfully designed training curricula
»» Get in-depth exposure to topics ranging from Maven and Nexus basics to advanced Nexus Lifecycle

Whether you are looking to train in a public classroom, at your site or online, we’ll help you to achieve and exceed your goals. In fact, we can even create a custom training course that’s designed around your specific needs. So, contact us today and let us help.

**Visit sonatype.com/training for more details.**