OSPS-VM.yaml

groups:
  - id: VM
    title: Vulnerability Management
    description: |
      Vulnerability Management focuses on the
      processes and practices used to identify and
      address security vulnerabilities in the project's
      software dependencies. These controls help ensure
      that the project is well positioned to respond to
      security threats and vulnerabilities in the software.
controls:
  - id: OSPS-VM-01
    title: |
      Publish Coordinated Vulnerability Disclosure Policy
    objective: |
      Establish a process for reporting and addressing vulnerabilities in the
      project, ensuring that security issues are handled promptly and
      transparently.
    group: VM
    guidelines:
      - reference-id: BPB
        entries:
          - reference-id: R-B-6
          - reference-id: R-B-8
          - reference-id: R-S-2
          - reference-id: S-B-14
          - reference-id: S-B-15
      - reference-id: CRA
        entries:
          - reference-id: 2.1
          - reference-id: 2.2
          - reference-id: 2.3
          - reference-id: 2.6
          - reference-id: 2.7
          - reference-id: 2.8
      - reference-id: SSDF
        entries:
          - reference-id: RV.1.3
      - reference-id: CSF
        entries:
          - reference-id: GV.PO-01
          - reference-id: GV.PO-02
          - reference-id: ID.RA-01
          - reference-id: ID.RA-08
      - reference-id: ISO-18974
        entries:
          - reference-id: 4.1.5
          - reference-id: 4.2.1
          - reference-id: 4.3.2
      - reference-id: OpenCRE
        entries:
          - reference-id: 887-750
      - reference-id: Scorecard
        entries:
          - reference-id: Security-Policy
      - reference-id: PSSCRM
        entries:
          - reference-id: D1.1
          - reference-id: D1.2
          - reference-id: D1.3
          - reference-id: D1.5
      - reference-id: SAMM
        entries:
          - reference-id: Governance -Create and Promote Lvl2
          - reference-id: Governance -Policy & Compliance -Policy & Standards Lvl1
          - reference-id: Implementation -Defect Management -Defect Tracking Lvl1
          - reference-id: Implementation -Defect Management -Defect Tracking Lvl2
          - reference-id: Implementation -Defect Management -Defect Tracking Lvl3
          - reference-id: Operations -Incident Management -Incident Response Lvl1
          - reference-id: Operations -Incident Management -Incident Response Lvl2
          - reference-id: Operations -Incident Management -Incident Response Lvl3
      - reference-id: PCIDSS
        entries:
          - reference-id: 2.1.1
          - reference-id: 3.1.1
          - reference-id: 4.1.1
          - reference-id: 5.1.1
          - reference-id: 6.1.1
          - reference-id: 6.3.1
          - reference-id: 6.3.2
          - reference-id: 7.1.1
          - reference-id: 8.1.1
          - reference-id: 11.1.1
          - reference-id: 11.2.1
          - reference-id: 12.1.1
          - reference-id: 12.1.3
      - reference-id: 800-161
        entries:
          - reference-id: IR-1
          - reference-id: IR-4
          - reference-id: IR-6
          - reference-id: IR-7(1)
          - reference-id: IR-8
          - reference-id: SI-2          
      - reference-id: UKSSCOP
        entries:
          - reference-id: Claim 3.4.1
          - reference-id: Claim 3.5.1
          - reference-id: Claim 4.1.2
      - reference-id: BSI-TR-03185-2
        entries:
          - reference-id: VM.01
    assessment-requirements:
      - id: OSPS-VM-01.01
        text: |
          While active, the project documentation MUST
          include a policy for coordinated vulnerability disclosure (CVD), with a clear
          timeframe for response.
        applicability:
          - maturity-2
          - maturity-3
        recommendation: |
          Create a SECURITY.md file at the root of the directory, outlining the
          project's policy for coordinated vulnerability disclosure. Include a
          method for reporting vulnerabilities. Set expectations for how the
          project will respond and address reported issues.

  - id: OSPS-VM-02
    title: |
      Publish Contacts and Process for Reporting Vulnerabilities.
    objective: |
      Enable external parties, such as researchers, to easily understand who they 
      should contact in the event that a vulnerability is found, and what process
      they should follow.
    group: VM
    guidelines:
      - reference-id: BPB
        entries:
          - reference-id: B-S-8
      - reference-id: CRA
        entries:
          - reference-id: 2.5
      - reference-id: SSDF
        entries:
          - reference-id: RV.1.3
      - reference-id: CSF
        entries:
          - reference-id: GV.PO-01
          - reference-id: GV.PO-02
          - reference-id: ID.RA-01
      - reference-id: ISO-18974
        entries:
          - reference-id: 4.1.1
          - reference-id: 4.1.3
          - reference-id: 4.1.5
          - reference-id: 4.2.2
      - reference-id: OpenCRE
        entries:
          - reference-id: 464-513
      - reference-id: Scorecard
        entries:
          - reference-id: Security-Policy
      - reference-id: SAMM
        entries:
          - reference-id: Governance -Policy&Compliance -Policy&Standards Lvl2
      - reference-id: PCIDSS
        entries:
          - reference-id: 6.3.3
          - reference-id: 12.1.1
          - reference-id: 12.10.2
      - reference-id: UKSSCOP
        entries:
          - reference-id: 3.2
      - reference-id: 800-161
        entries:
          - reference-id: IR-1
          - reference-id: IR-4
          - reference-id: IR-6
          - reference-id: IR-8                
      - reference-id: BSI-TR-03185-2
        entries:
          - reference-id: VM.01
    assessment-requirements:
      - id: OSPS-VM-02.01
        text: |
          While active, the project documentation MUST contain
          security contacts.
        applicability:
          - maturity-1
        recommendation: |
          Create a security.md (or similarly-named) file that contains security
          contacts for the project.

  - id: OSPS-VM-03
    title: |
      Maintain Private Vulnerability Reporting Process
    objective: |
      Provide a means for reporting privately to the security contacts within
      the project so that security vulnerabilities are not be shared with the
      public until the project has been provided time to analyze and prepare
      remediations to protect users of the project.
    group: VM
    guidelines:
      - reference-id: BPB
        entries:
          - reference-id: R-B-7
      - reference-id: CRA
        entries:
          - reference-id: 2.5
          - reference-id: 2.6
      - reference-id: OpenCRE
        entries:
          - reference-id: 308-514
      - reference-id: SAMM
        entries:
          - reference-id: Operations -Incident Management -Incident Response Lvl3
      - reference-id: PCIDSS
        entries:
          - reference-id: 6.3.1
          - reference-id: 6.3.3
          - reference-id: 12.10.2
      - reference-id: UKSSCOP
        entries:
          - reference-id: 3.2
      - reference-id: 800-161
        entries:
          - reference-id: IR-6                
      - reference-id: BSI-TR-03185-2
        entries:
          - reference-id: VM.01
    assessment-requirements:
      - id: OSPS-VM-03.01
        text: |
          While active, the project documentation MUST
          provide a means for private vulnerability reporting directly to
          the security contacts within the project.
        applicability:
          - maturity-2
          - maturity-3
        recommendation: |
          Provide a means for security researchers to report vulnerabilities
          privately to the project. This may be a dedicated email address, a
          web form, VCS specialized tools, email addresses for security
          contacts, or other methods.

  - id: OSPS-VM-04
    title: |
      Publish Discovered Vulnerabilities
    objective: |
      Ensure that project end users have a well known mechanism to understand
      vulnerabilities found within the project.
    group: VM
    guidelines:
      - reference-id: CRA
        entries:
          - reference-id: 1.2a
          - reference-id: 1.2b
          - reference-id: 2.1
          - reference-id: 2.4
          - reference-id: 2.6
      - reference-id: SSDF
        entries:
          - reference-id: PO.4.1
          - reference-id: RV.2.1
          - reference-id: RV.2.2
      - reference-id: CSF
        entries:
          - reference-id: ID.RA-01
      - reference-id: ISO-18974
        entries:
          - reference-id: 4.1.5
      - reference-id: PSSCRM
        entries:
          - reference-id: G2.2
          - reference-id: D1.1
      - reference-id: PCIDSS
        entries:
          - reference-id: 6.2.3
          - reference-id: 6.3.1
          - reference-id: 6.3.2
          - reference-id: 6.3.3
          - reference-id: 11.3.1
      - reference-id: UKSSCOP
        entries:
          - reference-id: 3.4
          - reference-id: 3.5
          - reference-id: 4.3
      - reference-id: 800-161
        entries:
          - reference-id: CA-7
          - reference-id: CM-3
          - reference-id: CM-8
          - reference-id: IR-5
          - reference-id: SI-2
          - reference-id: SI-4
          - reference-id: SI-5                
      - reference-id: BSI-TR-03185-2
        entries:
          - reference-id: VM.02
    assessment-requirements:
      - id: OSPS-VM-04.01
        text: |
          While active, the project documentation MUST
          publicly publish data about discovered vulnerabilities.
        applicability:
          - maturity-2
          - maturity-3
        recommendation: |
          Provide information about known vulnerabilities in a predictable
          public channel, such as a CVE entry, blog post, or other medium.
          To the degree possible, this information should include affected
          version(s), how a consumer can determine if they are vulnerable, and
          instructions for mitigation or remediation.
      - id: OSPS-VM-04.02
        text: |
          While active, any vulnerabilities in the
          software components not affecting the project MUST be accounted for
          in a VEX document, augmenting the vulnerability report with
          non-exploitability details.
        applicability:
          - maturity-3
        recommendation: |
          Establish a VEX feed communicating the exploitability status of
          known vulnerabilities, including assessment details or any
          mitigations in place preventing vulnerable code from being
          executed.

  - id: OSPS-VM-05
    title: |
      Publish and Enforce a Dependency Remediation Policy
    objective: |
      Identify and address defects and security weaknesses in the project's
      imported code early in the development process, reducing the risk of
      shipping insecure software.
    group: VM
    guidelines:
      - reference-id: BPB
        entries:
          - reference-id: B-S-8
          - reference-id: Q-B-12
          - reference-id: Q-S-9
          - reference-id: S-B-14
          - reference-id: S-B-15
          - reference-id: A-B-1
          - reference-id: A-B-3
          - reference-id: A-B-8
          - reference-id: A-S-1
      - reference-id: CRA
        entries:
          - reference-id: 1.2a
          - reference-id: 1.2b
          - reference-id: 1.2c
          - reference-id: 2.1
          - reference-id: 2.2
          - reference-id: 2.3
          - reference-id: 2.4
      - reference-id: SSDF
        entries:
          - reference-id: PO.4
          - reference-id: PW.1.2
          - reference-id: PW.8.1
          - reference-id: RV.1.2
          - reference-id: RV.1.3
          - reference-id: RV.2.1
          - reference-id: RV.2.2
      - reference-id: CSF
        entries:
          - reference-id: GV.RM-05
          - reference-id: GV.RM-06
          - reference-id: GV.PO-01
          - reference-id: GV.PO-02
          - reference-id: ID.RA-01
          - reference-id: ID.RA-08
          - reference-id: ID.IM-02
      - reference-id: ISO-18974
        entries:
          - reference-id: 4.1.5
          - reference-id: 4.2.1
          - reference-id: 4.2.2
          - reference-id: 4.3.2
      - reference-id: OpenCRE
        entries:
          - reference-id: 155-155
          - reference-id: 124-564
          - reference-id: 757-271
          - reference-id: 464-513
          - reference-id: 611-158
          - reference-id: 207-435
          - reference-id: 088-377
      - reference-id: Scorecard
        entries:
          - reference-id: Security-Policy
          - reference-id: Vulnerabilities
      - reference-id: PSSCRM
        entries:
          - reference-id: G5.4
          - reference-id: P4.1
          - reference-id: P4.2
          - reference-id: P4.3
          - reference-id: P4.4
          - reference-id: P4.5
      - reference-id: SAMM
        entries:
          - reference-id: Implementation -Secure Build-Build Process Lvl3
          - reference-id: Implementation -Software Dependencies Lvl3
          - reference-id: Verification -Security Testing -Scalable Baseline Lvl1
          - reference-id: Verification -Security Testing -Scalable Baseline Lvl3
      - reference-id: PCIDSS
        entries:
          - reference-id: 6.2.3
          - reference-id: 6.3.1
          - reference-id: 6.3.2
          - reference-id: 6.4.1
          - reference-id: 6.4.2
      - reference-id: UKSSCOP
        entries:
          - reference-id: 1.2
          - reference-id: 3.3
      - reference-id: 800-161
        entries:
          - reference-id: CA-7
          - reference-id: RA-5
          - reference-id: SA-11
          - reference-id: SI-2
          - reference-id: SI-3                
    assessment-requirements:
      - id: OSPS-VM-05.01
        text: |
          While active, the project documentation MUST include a policy that
          defines a threshold for remediation of SCA findings related to
          vulnerabilities and licenses.
        applicability:
          - maturity-3
        recommendation: |
          Document a policy in the project that defines a threshold for
          remediation of SCA findings related to vulnerabilities and licenses.
          Include the process for identifying, prioritizing, and remediating
          these findings.
      - id: OSPS-VM-05.02
        text: |
          While active, the project documentation MUST include a policy to
          address SCA violations prior to any release.
        applicability:
          - maturity-3
        recommendation: |
          Document a policy in the project to address applicable Software
          Composition Analysis results before any release, and add status checks
          that verify compliance with that policy prior to release.
      - id: OSPS-VM-05.03
        text: |
          While active, all changes to the project's codebase MUST be
          automatically evaluated against a documented policy for malicious
          dependencies and known vulnerabilities in dependencies, then blocked
          in the event of violations, except when declared and suppressed as
          non-exploitable.
        applicability:
          - maturity-3
        recommendation: |
          Create a status check in the project's version control system that
          runs a Software Composition Analysis tool on all changes
          to the codebase. Require that the status check passes before changes
          can be merged.

  - id: OSPS-VM-06
    title: |
      Publish and Enforce an Application Security Testing Policy
    objective: |
      Identify and address defects and security weaknesses in the project's
      codebase early in the development process, reducing the risk of shipping
      insecure software.
    group: VM
    guidelines:
      - reference-id: BPB
        entries:
          - reference-id: B-S-8
          - reference-id: Q-B-12
          - reference-id: Q-S-9
          - reference-id: S-B-14
          - reference-id: S-B-15
          - reference-id: A-B-1
          - reference-id: A-B-3
          - reference-id: A-B-8
          - reference-id: A-S-1
      - reference-id: CRA
        entries:
          - reference-id: 1.2a
          - reference-id: 1.2b
          - reference-id: 1.2c
          - reference-id: 2.1
          - reference-id: 2.2
          - reference-id: 2.3
          - reference-id: 2.4
      - reference-id: SSDF
        entries:
          - reference-id: PO.4
          - reference-id: PW.1.2
          - reference-id: PW.8.1
          - reference-id: RV.1.2
          - reference-id: RV.1.3
          - reference-id: RV.2.1
          - reference-id: RV 2.2
      - reference-id: CSF
        entries:
          - reference-id: GV.RM-05
          - reference-id: GV.RM-06
          - reference-id: GV.PO-01
          - reference-id: GV.PO-02
          - reference-id: ID.RA-01
          - reference-id: ID.RA-08
          - reference-id: ID.IM-02
      - reference-id: ISO-18974
        entries:
          - reference-id: 4.1.5
          - reference-id: 4.2.1
          - reference-id: 4.2.2
          - reference-id: 4.3.2
      - reference-id: OpenCRE
        entries:
          - reference-id: 155-155
          - reference-id: 124-564
          - reference-id: 757-271
          - reference-id: 464-513
          - reference-id: 611-158
          - reference-id: 207-435
          - reference-id: 088-377
      - reference-id: Scorecard
        entries:
          - reference-id: Security-Policy
          - reference-id: Vulnerabilities
          - reference-id: SAST
      - reference-id: PSSCRM
        entries:
          - reference-id: G5.4
          - reference-id: P4.1
          - reference-id: P4.2
          - reference-id: P4.3
          - reference-id: P4.4
          - reference-id: P4.5
      - reference-id: SAMM
        entries:
          - reference-id: Implementation -Secure Build-Build Process Lvl3
          - reference-id: Implementation -Software Dependencies Lvl3
          - reference-id: Verification -Security Testing -Scalable Baseline Lvl1
          - reference-id: Verification -Security Testing -Scalable Baseline Lvl3
      - reference-id: PCIDSS
        entries:
          - reference-id: 6.2.3
          - reference-id: 6.3.1
          - reference-id: 6.3.2
          - reference-id: 6.4.1
          - reference-id: 6.4.2
          - reference-id: 6.5.2
      - reference-id: UKSSCOP
        entries:
          - reference-id: 1.3
          - reference-id: 1.4
      - reference-id: 800-161
        entries:
          - reference-id: CA-7
          - reference-id: RA-5
          - reference-id: SA-11
          - reference-id: SI-2
          - reference-id: SI-3     
      - reference-id: BSI-TR-03185-2
        entries:
          - reference-id: QA.05
    assessment-requirements:
      - id: OSPS-VM-06.01
        text: |
          While active, the project documentation MUST include a policy that
          defines a threshold for remediation of SAST findings.
        applicability:
          - maturity-3
        recommendation: |
          Document a policy in the project that defines a threshold for
          remediation of Static Application Security Testing (SAST) findings.
          Include the process for identifying, prioritizing, and remediating
          these findings.
      - id: OSPS-VM-06.02
        text: |
          While active, all changes to the project's codebase MUST be
          automatically evaluated against a documented policy for security
          weaknesses and blocked in the event of violations except when declared
          and suppressed as non-exploitable.
        applicability:
          - maturity-3
        recommendation: |
          Create a status check in the project's version control system that
          runs a Static Application Security Testing (SAST) tool on all changes
          to the codebase. Require that the status check passes before changes
          can be merged.