Establish and Document the Application's Packaging - Application Management Best Practices

Establish and Document the Application's Packaging

(Chapter 76 of Application Management Best Practices)

Executive Summary: Chapter Overview

IF4IT

The Bottom Line

Packaging turns built artifacts into versioned, distributable units ready for Deployment. This chapter covers package formats, contents and deliberate exclusions such as Security Secrets, versioning tied to exactly one Release and Build, tamper protection, storage, and a Software Bill of Materials for each Release. Done well, it guarantees that what was tested is exactly what is deployed and lets security teams match new vulnerabilities to the Application within minutes.

Core Concepts

ConceptDefinition & Strategic Role
PackagingThe process of assembling an Application’s built artifacts, configuration, and supporting files into versioned, distributable units (Packages) suitable for Deployment. Well-defined packages ensure every deployed unit can be traced to its Release.
Software Bill of Materials (SBOM)The list of components, including third-party and open-source components, contained in a Release’s package. Referenced from the Application’s security reviews, it lets newly announced vulnerabilities be matched against the Application quickly.
Package ExclusionsContent deliberately kept out of packages, such as environment-specific configuration and Security Secrets. Documenting what each package excludes, as well as what it contains, keeps sensitive values out of distributable units.
Package Signing and ProtectionSigning or otherwise protecting packages against tampering. Protection helps ensure that the package deployed is exactly the one that was built and tested for its Release.

Quick Q&A

Question: What should be documented about the contents of each Application package?

Answer: Document what each package contains, namely the Application’s built artifacts, configuration, and supporting files, and what is deliberately excluded, such as environment-specific configuration and Security Secrets. Also record the package format, how it is versioned and labeled to match exactly one Release and Build, how it is protected, and where it is stored.

Question: Why should each Release's Software Bill of Materials be referenced from the Application's security reviews?

Answer: Referencing the SBOM from the security reviews means newly announced vulnerabilities can be matched against the components actually contained in the package. This lets security teams determine within minutes whether a newly discovered vulnerability affects the Application, instead of investigating its contents from scratch.

Read More Below

Authored and Published By: The International Foundation for Information Technology (IF4IT), LLC

This chapter explains how to establish and document how an Application’s built artifacts are assembled into deployable packages.

Definition

Packaging is the process of assembling an Application’s built artifacts, configuration, and supporting files into versioned, distributable units (Packages) suitable for Deployment.

Establish the Packaging

Establish, with the IT Application Owner and the Development or Engineering Organization:

  • The package formats used, such as archives, installers, or container images.

  • What each package contains, and what is deliberately excluded, such as environment-specific configuration and Security Secrets.

  • How packages are versioned and labeled, so that each corresponds to exactly one Release and Build.

  • How packages are signed or otherwise protected against tampering.

  • Where packages are stored, typically in an artifact repository.

  • The Software Bill of Materials (SBOM) for each Release: the list of components, including third-party and open-source components, contained in the package.

Document and Share the Packaging

Record the packaging approach, package contents, versioning, protection, storage, and the SBOM for each Release in the Build, Packaging, and Configuration section of the Application Documentation. Reference the SBOM from the Application’s security reviews, so that newly announced vulnerabilities can be matched against it. Record any packaging differences between Instances explicitly.

Best Practice: Establish and Document the Application’s Packaging

It is a best practice to both establish and document the solution for how an Application is packaged for Deployment: define its package formats, contents, versioning, protection, and storage, and record a Software Bill of Materials for each Release.

Benefits: Well-defined, versioned, and protected packages ensure that what is tested is exactly what is deployed, and that every deployed package can be traced to its Release. A Software Bill of Materials for each Release lets security teams determine within minutes whether a newly discovered vulnerability affects the Application.

The Release Management Best Practices addresses how packaged Release content is managed. The Software Technologies Inventory and Attributes describes how the technologies contained in packages are recorded.

How to cite this page

When referencing this page in academic work, internal standards, or external publications, include the page title, IF4IT as author and publisher (The International Foundation for Information Technology (IF4IT), LLC), the URL, and your access date.

Example (informal web citation):

The International Foundation for Information Technology (IF4IT), LLC. Establish and Document the Application's Packaging | Application Management Best Practices. https://if4it.org/best-practices/application-management-best-practices/establish-and-document-the-application-s-packaging/ (accessed 2026-10-31).

See About Us for content governance and site-wide citation guidance.

Copyright for The International Foundation for Information Technology (IF4IT), LLC: 2008 - Present

Legal Disclaimers
Share:
Contact Us → Subscribe →