Software Asset & Configuration Register

Version: 2.0 Last Updated: March 2026 Owner: CTO

1. Asset Management Process

CheckTick tracks software assets through a Managed Repository model:

• Discovery: All new software or libraries must be approved by the CTO before being added to pyproject.toml or package.json. No dependency may be added to production without CTO review via the pull request process.
• Version Tracking: Automated via GitHub Dependency Graph and Dependabot, which monitors all declared dependencies continuously against known vulnerability databases. Any vulnerable dependency causes an immediate CI/CD pipeline failure blocking deployment.
• Vulnerability Scanning: pip-audit runs on every push, pull request, and daily at 06:00 UTC. CodeQL scans all application code on every commit. EatYourPeas Ltd is a registered NCSC Early Warning subscriber, providing direct notification of relevant threats and advisories.
• Audit: A manual reconciliation of this register is performed quarterly to ensure decommissioned tools are removed and version numbers are current.

2. Core Application Dependencies (Production)

Sourced from pyproject.toml — managed via Poetry. All versions are locked in poetry.lock for reproducible builds.

Active Vulnerability Exceptions

3. Development Dependencies

Used in development and CI/CD pipeline only. Not present in production container images.

4. Frontend Build Dependencies

Managed via package.json. Used at build time only to generate compiled CSS. No JavaScript framework is shipped to the browser.

5. Self-Hosted JavaScript Assets

Served from checktick_app/static/js/ with SHA-384 Subresource Integrity (SRI) verification. No external CDN calls are made in production.

6. Infrastructure & Platform Services

7. Approved Staff Software (EatYourPeas Ltd Devices)

All software installed on staff devices must be pre-approved by the CTO. This satisfies the Cyber Essentials Plus requirement for controlled software installation.

7.1 Approval Process

1. Staff member identifies need for new software
2. CTO evaluates security posture, data handling, and business necessity
3. CTO adds approved software to this register
4. Installation permitted only from official sources (App Store, identified developers, Google Play Store)

7.2 Approved Software List

7.3 Prohibited Software Categories

• Remote access or screen sharing tools not explicitly approved
• Consumer file sharing services (OneDrive personal, Google Drive personal, Dropbox) for any business or patient data
• Cryptocurrency mining software
• Penetration testing tools on production systems
• Software that disables security features
• Pirated or unlicensed software
• Software from unverified or unknown sources

7.4 Technical Enforcement

• macOS: Gatekeeper restricts installation to App Store and identified developers
• Windows: SmartScreen blocks unrecognised or unsigned applications
• iOS/Android: App Store / Google Play only; jailbreaking and rooting prohibited
• Administrative controls: Standard user accounts prevent unauthorised software installation on all devices

8. Configuration Baseline

All assets are configured in accordance with the CheckTick Infrastructure Hardening Standard:

• All administrative accounts protected by MFA with zero exceptions
• Non-essential ports and services disabled by default on all infrastructure
• Production data encrypted at rest (AES-256-GCM) and in transit (TLS 1.2+)
• No default or vendor-supplied credentials retained on any system
• All configuration changes managed via pull request review and logged in the Infrastructure Technical Change Log