diff --git a/.github/workflows/cue-validate.yaml b/.github/workflows/cue-validate.yaml index 8ecfad54..d0ccfb7c 100644 --- a/.github/workflows/cue-validate.yaml +++ b/.github/workflows/cue-validate.yaml @@ -39,3 +39,11 @@ jobs: - name: Validate catalog against CUE schema run: cd schema && cue vet -d '#OSPSBaseline' . ../baseline.gemara.yaml + + - name: Validate mapping documents against CUE schema + run: | + cd schema + for f in ../baseline/mappings/*.yaml; do + echo "vetting $f" + cue vet -d '#OSPSMapping' . "$f" + done diff --git a/baseline/OSPS-AC.yaml b/baseline/OSPS-AC.yaml index 6b6e351f..c3b1bb08 100644 --- a/baseline/OSPS-AC.yaml +++ b/baseline/OSPS-AC.yaml @@ -17,66 +17,6 @@ controls: multi-factor authentication for collaborators modifying the project repository settings or accessing sensitive data. group: AC - guidelines: - - reference-id: BPB - entries: - - reference-id: CC-G-1 - - reference-id: CRA - entries: - - reference-id: 1.2d - - reference-id: 1.2e - - reference-id: 1.2f - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: CSF - entries: - - reference-id: PR.A-02 - - reference-id: PR.A-05 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: 347-352 - - reference-id: 333-858 - - reference-id: 152-725 - - reference-id: 201-246 - - reference-id: PSSCRM - entries: - - reference-id: G2.6 - - reference-id: P3.3 - - reference-id: E1.2 - - reference-id: E1.3 - - reference-id: E1.4 - - reference-id: E3.1 - - reference-id: SAMM - entries: - - reference-id: Operations -Environment Management -Configuration Hardening Lvl1 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 8.2.1 - - reference-id: 8.3.1 - - reference-id: 800-161 - entries: - - reference-id: AC-4(21) - - reference-id: AC-17 - - reference-id: CM-5 - - reference-id: CM-6 - - reference-id: IA-2 - - reference-id: IA-5 - - reference-id: 1.2e - - reference-id: 1.2f - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.4.2 - - reference-id: Claim 2.1.5 - - reference-id: Claim 2.2.2 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: GV.02 assessment-requirements: - id: OSPS-AC-01.01 text: | @@ -100,50 +40,6 @@ controls: Reduce the risk of unauthorized access to the project's repository by limiting the permissions granted to new collaborators. group: AC - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2f - - reference-id: SSDF - entries: - - reference-id: PO.2 - - reference-id: PO.3.2 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: CSF - entries: - - reference-id: PR.AA-02 - - reference-id: PR.AA-05 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: 802-056 - - reference-id: 368-633 - - reference-id: 152-725 - - reference-id: PSSCRM - entries: - - reference-id: P2.3 - - reference-id: E1.2 - - reference-id: E3.3 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 800-161 - entries: - - reference-id: AC-2 - - reference-id: AC-3 - - reference-id: AC-4(21) - - reference-id: AC-5 - - reference-id: AC-6 - - reference-id: CM-5 - - reference-id: CM-7 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 2.2.2 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: GV.02 assessment-requirements: - id: OSPS-AC-02.01 text: | @@ -167,51 +63,6 @@ controls: Reduce the risk of accidental changes or deletion of the primary branch of the project's repository by preventing unintentional modification. group: AC - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2f - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: CSF - entries: - - reference-id: PR.A-02 - - reference-id: PR.A-05 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: 152-725 - - reference-id: Scorecard - entries: - - reference-id: Branch-Protection - - reference-id: PSSCRM - entries: - - reference-id: P3.2 - - reference-id: P3.5 - - reference-id: E1.5 - - reference-id: E3.1 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 800-161 - entries: - - reference-id: AC-3 - - reference-id: AC-5 - - reference-id: CM-3 - - reference-id: CM-3(2) - - reference-id: CM-5 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.1.4 - - reference-id: Claim 2.2.2 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: GV.02 - - reference-id: QA.06 assessment-requirements: - id: OSPS-AC-03.01 text: | @@ -248,58 +99,6 @@ controls: processes by limiting the permissions granted to steps within the CI/CD pipelines. group: AC - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2d - - reference-id: 1.2e - - reference-id: 1.2f - - reference-id: SSDF - entries: - - reference-id: PO.2 - - reference-id: PO.3.2 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: CSF - entries: - - reference-id: PR.AA-02 - - reference-id: PR.AA-05 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: 347-507 - - reference-id: 263-284 - - reference-id: 123-124 - - reference-id: SLSA - entries: - - reference-id: Producer - Choose an appropriate build platform - - reference-id: Build platform - Isolation strength - Isolated - - reference-id: PSSCRM - entries: - - reference-id: P3.2 - - reference-id: SAMM - entries: - - reference-id: Operations -Environment Management -Configuration Hardening Lvl1 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 8.2.1 - - reference-id: 800-161 - entries: - - reference-id: AC-3(8) - - reference-id: AC-4 - - reference-id: AC-4(6) - - reference-id: AC-6 - - reference-id: AC-20 - - reference-id: AC-20(1) - - reference-id: CM-5 - - reference-id: CM-7 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 2.1.1 - - reference-id: Claim 2.1.3 - - reference-id: Claim 2.2.2 assessment-requirements: - id: OSPS-AC-04.01 text: | diff --git a/baseline/OSPS-BR.yaml b/baseline/OSPS-BR.yaml index 9f0001af..48275a73 100644 --- a/baseline/OSPS-BR.yaml +++ b/baseline/OSPS-BR.yaml @@ -18,54 +18,6 @@ controls: project's build and release pipelines by preventing untrusted input from accessing privileged resources. group: BR - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2f - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: PO.5.2 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: Scorecard - entries: - - reference-id: Dangerous-Workflow - - reference-id: CSF - entries: - - reference-id: PR.AA-02 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: 357-352 - - reference-id: SLSA - entries: - - reference-id: Choose an appropriate build platform - - reference-id: PSSCRM - entries: - - reference-id: P2.3 - - reference-id: P3.2 - - reference-id: P3.5 - - reference-id: E2.4 - - reference-id: E2.5 - - reference-id: D2.2 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 6.4.1 - - reference-id: 800-161 - entries: - - reference-id: AC-3 - - reference-id: AC-4 - - reference-id: AC-4(21) - - reference-id: CM-5 - - reference-id: CM-7 - - reference-id: SI-7 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 2.1.2 - - reference-id: Claim 2.2.2 assessment-requirements: - id: OSPS-BR-01.01 text: | @@ -123,52 +75,6 @@ controls: identified, enabling users to track changes and updates to the project over time. group: BR - guidelines: - - reference-id: BPB - entries: - - reference-id: CC-B-5 - - reference-id: CC-B-6 - - reference-id: CC-B-7 - - reference-id: CRA - entries: - - reference-id: 1.2f - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: PS.3 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: SLSA - entries: - - reference-id: Follow a consistent build process - - reference-id: Provenance generation- Exists, Authentic - - reference-id: PSSCRM - entries: - - reference-id: G1.4 - - reference-id: E1.2 - - reference-id: E2.1 - - reference-id: E2.6 - - reference-id: PCIDSS - entries: - - reference-id: 6.4.3 - - reference-id: 800-161 - entries: - - reference-id: IA-4 - - reference-id: SA-15 - - reference-id: SI-7 - - reference-id: SR-4 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.1.4 - - reference-id: Claim 3.1.1 - - reference-id: Claim 3.4.2 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: BR.02 assessment-requirements: - id: OSPS-BR-02.01 text: | @@ -200,56 +106,6 @@ controls: Protect the confidentiality and integrity of project source code during development, reducing the risk of eavesdropping or data tampering. group: BR - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-11 - - reference-id: CRA - entries: - - reference-id: 1.2d - - reference-id: 1.2e - - reference-id: 1.2f - - reference-id: 1.2i - - reference-id: 1.2j - - reference-id: 1.2k - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: PO.5.2 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: OpenCRE - entries: - - reference-id: 483-813 - - reference-id: 124-564 - - reference-id: 263-184 - - reference-id: SLSA - entries: - - reference-id: Choose an appropriate build platform - - reference-id: PSSCRM - entries: - - reference-id: E1.1 - - reference-id: E2.2 - - reference-id: E2.4 - - reference-id: E2.5 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 2.2.7 - - reference-id: 4.2.1 - - reference-id: 4.2.2 - - reference-id: 6.4.1 - - reference-id: 8.3.2 - - reference-id: 800-161 - entries: - - reference-id: AC-4 - - reference-id: AC-4(21) - - reference-id: UKSSCOP - entries: - - reference-id: Claim 3.1.2 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: BR.03 assessment-requirements: - id: OSPS-BR-03.01 text: | @@ -288,78 +144,6 @@ controls: software releases in such a way that users can understand the modifications and improvements included in each release. group: BR - guidelines: - - reference-id: BPB - entries: - - reference-id: CC-B-8 - - reference-id: CC-B-9 - - reference-id: Q-B-7 - - reference-id: A-B-1 - - reference-id: A-S-1 - - reference-id: CRA - entries: - - reference-id: 1.2d - - reference-id: 1.2f - - reference-id: 1.2h - - reference-id: 1.2j - - reference-id: 1.2l - - reference-id: 2.5 - - reference-id: SSDF - entries: - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: PS.3 - - reference-id: PW.1.2 - - reference-id: OpenCRE - entries: - - reference-id: 483-813 - - reference-id: 068-486 - - reference-id: 124-564 - - reference-id: 757-271 - - reference-id: 347-352 - - reference-id: 263-184 - - reference-id: 208-355 - - reference-id: 745-356 - - reference-id: 732-148 - - reference-id: SLSA - entries: - - reference-id: Choose an appropriate build platform - - reference-id: Follow a consistent build process - - reference-id: Build platform - Isolation strength - isolated - - reference-id: PSSCRM - entries: - - reference-id: G1.4 - - reference-id: E2.1 - - reference-id: E2.4 - - reference-id: E2.5 - - reference-id: E3.1 - - reference-id: E3.6 - - reference-id: PCIDSS - entries: - - reference-id: 6.2.1 - - reference-id: 6.4.1 - - reference-id: 6.5.1 - - reference-id: 6.5.2 - - reference-id: 10.2.2 - - reference-id: 800-161 - entries: - - reference-id: AU-2 - - reference-id: AU-6 - - reference-id: AU-10 - - reference-id: CM-5 - - reference-id: CM-6 - - reference-id: MA-1 - - reference-id: MA-8 - - reference-id: SI-4 - - reference-id: SI-5 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.1.4 - - reference-id: Claim 2.2.3 - - reference-id: Claim 3.1.1 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: BR.04 assessment-requirements: - id: OSPS-BR-04.01 text: | @@ -385,61 +169,6 @@ controls: and processes to manage dependencies, reducing the risk of compatibility issues or security vulnerabilities in the software. group: BR - guidelines: - - reference-id: BPB - entries: - - reference-id: Q-B-2 - - reference-id: CRA - entries: - - reference-id: 1.2b - - reference-id: 1.2d - - reference-id: 1.2f - - reference-id: 1.2h - - reference-id: 1.2j - - reference-id: 2.1 - - reference-id: 2.2 - - reference-id: 2.3 - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: 347-352 - - reference-id: 715-334 - - reference-id: SLSA - entries: - - reference-id: Isolation strength - isolated - - reference-id: PSSCRM - entries: - - reference-id: P3.1 - - reference-id: P3.5 - - reference-id: E2.2 - - reference-id: E2.3 - - reference-id: E2.4 - - reference-id: E2.5 - - reference-id: SAMM - entries: - - reference-id: Implementation -Secure Build -Build Process Lvl2 - - reference-id: PCIDSS - entries: - - reference-id: 6.4.3 - - reference-id: 800-161 - entries: - - reference-id: AC-4 - - reference-id: CM-2 - - reference-id: CM-7(4) - - reference-id: CM-7(5) - - reference-id: RA-5 - - reference-id: SA-15 - - reference-id: SR-3 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.2.1 - - reference-id: Claim 1.2.5 assessment-requirements: - id: OSPS-BR-05.01 text: | @@ -462,53 +191,6 @@ controls: Ensure released software assets can be verified by users to ensure integrity of each asset when it is used. group: BR - guidelines: - - reference-id: SSDF - entries: - - reference-id: PO.5.2 - - reference-id: PS.2 - - reference-id: PS.2.1 - - reference-id: PW.6.2 - - reference-id: Scorecard - entries: - - reference-id: Signed-Releases - - reference-id: SLSA - entries: - - reference-id: Distribute provenance - Exists - - reference-id: PSSCRM - entries: - - reference-id: P1.2 - - reference-id: P3.2 - - reference-id: P3.3 - - reference-id: E2.1 - - reference-id: E2.2 - - reference-id: E2.6 - - reference-id: SAMM - entries: - - reference-id: Implementation -Secure Deployment -Deployment Process Lvl3 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 2.2.7 - - reference-id: 3.5.1 - - reference-id: 4.2.1 - - reference-id: 4.2.2 - - reference-id: 6.4.1 - - reference-id: 8.3.2 - - reference-id: 800-161 - entries: - - reference-id: AU-10 - - reference-id: MP-1 - - reference-id: SA-15 - - reference-id: SI-7 - - reference-id: SI-7(14) - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.2.2 - - reference-id: Claim 3.1.1 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: BR.03 assessment-requirements: - id: OSPS-BR-06.01 text: | @@ -531,23 +213,6 @@ controls: Ensure that data which can lead to security vulnerabilities or supply chain compromise is not disclosed, compromised, or misused. group: BR - guidelines: - - reference-id: BPB - entries: - - reference-id: S-B-5 # TODO: is this the right numbering for https://www.bestpractices.dev/en/criteria#0.no_leaked_credentials - - reference-id: SSDF - entries: - - reference-id: PO.1.1 - - reference-id: P0.3.1 - - reference-id: P0.4.2 - - reference-id: PO.5.1 - - reference-id: PW.1.2 - - reference-id: PW.1.3 - - reference-id: PW.5.1 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.4.3 - - reference-id: Claim 1.4.5 assessment-requirements: - id: OSPS-BR-07.01 text: | diff --git a/baseline/OSPS-DO.yaml b/baseline/OSPS-DO.yaml index 961373c6..ea42cedd 100644 --- a/baseline/OSPS-DO.yaml +++ b/baseline/OSPS-DO.yaml @@ -18,60 +18,6 @@ controls: project's current features in order to prevent damage from misuse or misconfiguration. group: DO - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-1 - - reference-id: B-B-9 - - reference-id: B-S-7 - - reference-id: B-S-9 - - reference-id: CRA - entries: - - reference-id: 1.2b - - reference-id: 1.2j - - reference-id: 1.2k - - reference-id: SSDF - entries: - - reference-id: PW.1.2 - - reference-id: CSF - entries: - - reference-id: GV.OC-04 - - reference-id: GV.OC-05 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.4 - - reference-id: OpenCRE - entries: - - reference-id: 036-275 - - reference-id: PSSCRM - entries: - - reference-id: G5.1 - - reference-id: E3.5 - - reference-id: PCIDSS - entries: - - reference-id: 2.1.1 - - reference-id: 2.2.1 - - reference-id: 3.1.1 - - reference-id: 4.1.1 - - reference-id: 5.1.1 - - reference-id: 6.1.1 - - reference-id: 6.2.1 - - reference-id: 7.1.1 - - reference-id: 8.1.1 - - reference-id: 11.1.1 - - reference-id: 12.10.5 - - reference-id: UKSSCOP - entries: - - reference-id: 4.1 - - reference-id: 800-161 - entries: - - reference-id: CM-2 - - reference-id: PL-2 - - reference-id: PL-8 - - reference-id: SA-15 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: BR.01 assessment-requirements: - id: OSPS-DO-01.01 text: | @@ -95,58 +41,6 @@ controls: released software assets, facilitating communication and collaboration on defect fixes and improvements. group: DO - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-3 - - reference-id: R-B-1+ - - reference-id: R-B-1 - - reference-id: R-B-2 - - reference-id: R-S-2 - - reference-id: CRA - entries: - - reference-id: 1.2c - - reference-id: 1.2l - - reference-id: 2.1 - - reference-id: 2.2 - - reference-id: 2.5 - - reference-id: 2.6 - - reference-id: SSDF - entries: - - reference-id: PW.1.2 - - reference-id: RV.1.1 - - reference-id: RV.2.1 - - reference-id: RV.1.2 - - reference-id: CSF - entries: - - reference-id: RS.MA-02 - - reference-id: GV.RM-05 - - reference-id: ISO-18974 - entries: - - reference-id: 4.2.1 - - reference-id: SAMM - entries: - - reference-id: Implementation -Defect Management -Defect Tracking Lvl1 - - reference-id: Implementation -Defect Management -Defect Tracking Lvl2 - - reference-id: PCIDSS - entries: - - reference-id: 6.3.2 - - reference-id: 6.3.3 - - reference-id: 6.5.1 - - reference-id: 6.5.2 - - reference-id: 12.10.2 - - reference-id: UKSSCOP - entries: - - reference-id: 1.1 - - reference-id: 1.3 - - reference-id: 800-161 - entries: - - reference-id: IR-6 - - reference-id: SI-4 - - reference-id: SI-5 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.03 assessment-requirements: - id: OSPS-DO-02.01 text: | @@ -171,58 +65,6 @@ controls: released software assets, reducing the risk of using tampered or unauthorized versions of the software. group: DO - guidelines: - - reference-id: BPB - entries: - - reference-id: CC-B-8 - - reference-id: CRA - entries: - - reference-id: 1.2d - - reference-id: SSDF - entries: - - reference-id: PO.4.2 - - reference-id: PS.2 - - reference-id: PS.2.1 - - reference-id: PS.3.1 - - reference-id: RV.1.3 - - reference-id: OpenCRE - entries: - - reference-id: 171-222 - - reference-id: PSSCRM - entries: - - reference-id: G1.3 - - reference-id: G2.5 - - reference-id: P1.2 - - reference-id: P3.1 - - reference-id: P3.2 - - reference-id: P3.3 - - reference-id: E2.6 - - reference-id: PCIDSS - entries: - - reference-id: 3.1.1 - - reference-id: 3.5.1 - - reference-id: 4.1.1 - - reference-id: 5.1.1 - - reference-id: 6.1.1 - - reference-id: 6.2.1 - - reference-id: 7.1.1 - - reference-id: 8.1.1 - - reference-id: 11.1.1 - - reference-id: UKSSCOP - entries: - - reference-id: 3.1 - - reference-id: 800-161 - entries: - - reference-id: CM-2 - - reference-id: IR-1 - - reference-id: MP-1 - - reference-id: SA-15 - - reference-id: SI-7 - - reference-id: SI-7(14) - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: BR.01 - - reference-id: BR.03 assessment-requirements: - id: OSPS-DO-03.01 text: | @@ -262,54 +104,6 @@ controls: lifecycle in such a way that enables downstream consumers to ensure the continued functionality and security of their systems. group: DO - guidelines: - - reference-id: BPB - entries: - - reference-id: R-B-3 - - reference-id: SSDF - entries: - - reference-id: PO.4.2 - - reference-id: PS.3.1 - - reference-id: RV.1.3 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1 - - reference-id: 4.3.1 - - reference-id: PSSCRM - entries: - - reference-id: E1.6 - - reference-id: SAMM - entries: - - reference-id: Operations -Operational Management -System Decommissioning -Legacy Management Lvl1 - - reference-id: PCIDSS - entries: - - reference-id: 2.1.1 - - reference-id: 3.1.1 - - reference-id: 3.2.1 - - reference-id: 4.1.1 - - reference-id: 5.1.1 - - reference-id: 6.1.1 - - reference-id: 6.3.3 - - reference-id: 7.1.1 - - reference-id: 8.1.1 - - reference-id: 11.1.1 - - reference-id: UKSSCOP - entries: - - reference-id: 4.1 - - reference-id: 4.2 - - reference-id: 800-161 - entries: - - reference-id: PL-1 - - reference-id: PL-2 - - reference-id: SI-4 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 4.1.1 - - reference-id: Claim 4.1.2 - - reference-id: Claim 4.2.1 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: DE.01 assessment-requirements: - id: OSPS-DO-04.01 text: | @@ -334,54 +128,6 @@ controls: Communicate when the project maintainers will no longer fix defects or security vulnerabilities. group: DO - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2c - - reference-id: 2.6 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.1 - - reference-id: 4.3.1 - - reference-id: OpenCRE - entries: - - reference-id: 673-475 - - reference-id: 053-751 - - reference-id: PSSCRM - entries: - - reference-id: E1.6 - - reference-id: SAMM - entries: - - reference-id: Operations -Operational Management -System Decommissioning -Legacy Management Lvl1 - - reference-id: Operations -Operational Management -System Decommissioning -Legacy Management Lvl2 - - reference-id: PCIDSS - entries: - - reference-id: 3.1.1 - - reference-id: 3.2.1 - - reference-id: 4.1.1 - - reference-id: 5.1.1 - - reference-id: 6.1.1 - - reference-id: 6.3.2 - - reference-id: 7.1.1 - - reference-id: 8.1.1 - - reference-id: 11.1.1 - - reference-id: UKSSCOP - entries: - - reference-id: 3.5 - - reference-id: 4.1 - - reference-id: 800-161 - entries: - - reference-id: PL-1 - - reference-id: PL-2 - - reference-id: SI-4 - - reference-id: SI-5 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 4.1.1 - - reference-id: Claim 4.2.1 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: DE.01 assessment-requirements: - id: OSPS-DO-05.01 text: | @@ -402,67 +148,6 @@ controls: Provide information about how the project selects, obtains, and tracks third-party components that are required for the software to function. group: DO - guidelines: - - reference-id: BPB - entries: - - reference-id: A-S-1 - - reference-id: CRA - entries: - - reference-id: 2.1 - - reference-id: OpenCRE - entries: - - reference-id: 613-286 - - reference-id: 053-751 - - reference-id: Scorecard - entries: - - reference-id: Pinned-Dependencies - - reference-id: PSSCRM - entries: - - reference-id: G1.4 - - reference-id: G2.4 - - reference-id: P3.1 - - reference-id: P3.2 - - reference-id: P3.4 - - reference-id: SAMM - entries: - - reference-id: Design -Security Requirements -Supplier Security Lvl2 - - reference-id: PCIDSS - entries: - - reference-id: 2.1.1 - - reference-id: 3.1.1 - - reference-id: 4.1.1 - - reference-id: 5.1.1 - - reference-id: 6.1.1 - - reference-id: 6.3.2 - - reference-id: 6.4.3 - - reference-id: 7.1.1 - - reference-id: 8.1.1 - - reference-id: 11.1.1 - - reference-id: 12.5.2 - - reference-id: UKSSCOP - entries: - - reference-id: 1.2 - - reference-id: 3.3 - - reference-id: 800-161 - entries: - - reference-id: CA-7 - - reference-id: CM-7(5) - - reference-id: CM-8 - - reference-id: PM-30 - - reference-id: RA-3(1) - - reference-id: SA-11 - - reference-id: SI-4 - - reference-id: SR-3 - - reference-id: SR-5 - - reference-id: SR-6 - - reference-id: SR-7 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.2.1 - - reference-id: Claim 1.2.2 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.01 assessment-requirements: - id: OSPS-DO-06.01 text: | @@ -484,10 +169,6 @@ controls: Ensure that users have a clear and comprehensive instructions on how to build the software from source code. group: DO - guidelines: - - reference-id: - entries: - - reference-id: assessment-requirements: - id: OSPS-DO-07.01 text: | diff --git a/baseline/OSPS-GV.yaml b/baseline/OSPS-GV.yaml index dbf0104a..04cd2e9f 100644 --- a/baseline/OSPS-GV.yaml +++ b/baseline/OSPS-GV.yaml @@ -16,50 +16,6 @@ controls: potential contributors, and downstream consumers understand who is working on the project and what areas of authority they may have. group: GV - guidelines: - - reference-id: BPB - entries: - - reference-id: B-S-3 - - reference-id: B-S-4 - - reference-id: OpenCRE - entries: - - reference-id: 013-021 - - reference-id: PSSCRM - entries: - - reference-id: G2.3 - - reference-id: E3.1 - - reference-id: E3.3 - - reference-id: PCIDSS - entries: - - reference-id: 2.1.2 - - reference-id: 3.1.1 - - reference-id: 3.1.2 - - reference-id: 4.1.1 - - reference-id: 4.1.2 - - reference-id: 5.1.1 - - reference-id: 5.1.2 - - reference-id: 6.1.1 - - reference-id: 6.1.2 - - reference-id: 6.5.4 - - reference-id: 7.1.1 - - reference-id: 7.1.2 - - reference-id: 8.1.1 - - reference-id: 8.1.2 - - reference-id: 11.1.1 - - reference-id: 11.1.2 - - reference-id: 12.1.3 - - reference-id: 12.5.2 - - reference-id: 800-161 - entries: - - reference-id: AC-2 - - reference-id: AC-3 - - reference-id: IA-2 - - reference-id: PL-1 - - reference-id: PL-4 - - reference-id: PM-30 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 2.1.1 assessment-requirements: - id: OSPS-GV-01.01 text: | @@ -94,32 +50,6 @@ controls: community by enabling users to provide feedback and discuss proposed changes or usage challenges. group: GV - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-3 - - reference-id: B-B-12 - - reference-id: CRA - entries: - - reference-id: 1.2l - - reference-id: 2.3 - - reference-id: 2.4 - - reference-id: 2.6 - - reference-id: SSDF - entries: - - reference-id: PS.3 - - reference-id: PW.1.2 - - reference-id: PCIDSS - entries: - - reference-id: 12.5.2 - - reference-id: 800-161 - entries: - - reference-id: AC-21 - - reference-id: AU-6 - - reference-id: PL-1 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.03 assessment-requirements: - id: OSPS-GV-02.01 text: | @@ -141,47 +71,6 @@ controls: Provide guidance on how to participate in the project, outlining the steps required to submit changes or enhancements to the project's codebase. group: GV - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-4 - - reference-id: B-S-3 - - reference-id: B-B-4+ - - reference-id: R-B-1 - - reference-id: Q-G-2 - - reference-id: CRA - entries: - - reference-id: 1.2l - - reference-id: 2.4 - - reference-id: SSDF - entries: - - reference-id: PW.1.2 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.2 - - reference-id: PSSCRM - entries: - - reference-id: G2.4 - - reference-id: P2.2 - - reference-id: PCIDSS - entries: - - reference-id: 2.1.1 - - reference-id: 6.5.4 - - reference-id: 8.2.1 - - reference-id: 12.5.2 - - reference-id: 800-161 - entries: - - reference-id: AC-3 - - reference-id: AC-20 - - reference-id: PL-1 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 2.1.1 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: GV.01 - - reference-id: QA.04 - - reference-id: QA.05 assessment-requirements: - id: OSPS-GV-03.01 text: | @@ -217,58 +106,6 @@ controls: elevated permissions to sensitive resources within the project, reducing the risk of unauthorized access or misuse. group: GV - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-5 - - reference-id: B-S-3 - - reference-id: B-B-4+ - - reference-id: Q-G-2 - - reference-id: CRA - entries: - - reference-id: 1.2d - - reference-id: 1.2l - - reference-id: 2.1 - - reference-id: 2.2 - - reference-id: 2.5 - - reference-id: 2.6 - - reference-id: SSDF - entries: - - reference-id: PO.2 - - reference-id: PO.3.2 - - reference-id: CSF - entries: - - reference-id: PR.AA-02 - - reference-id: PR.AA-05 - - reference-id: OpenCRE - entries: - - reference-id: 123-124 - - reference-id: 152-725 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.2 - - reference-id: PSSCRM - entries: - - reference-id: E3.1 - - reference-id: E3.3 - - reference-id: PCIDSS - entries: - - reference-id: 2.1.1 - - reference-id: 6.5.4 - - reference-id: 8.2.1 - - reference-id: 8.2.2 - - reference-id: 800-161 - entries: - - reference-id: AC-2 - - reference-id: AC-3 - - reference-id: AC-4(21) - - reference-id: AC-5 - - reference-id: AC-6 - - reference-id: AC-20 - - reference-id: CM-7 - - reference-id: IR-4(6) - - reference-id: PM-30 - - reference-id: SI-4 assessment-requirements: - id: OSPS-GV-04.01 text: | diff --git a/baseline/OSPS-LE.yaml b/baseline/OSPS-LE.yaml index a21be3bd..e0c557a0 100644 --- a/baseline/OSPS-LE.yaml +++ b/baseline/OSPS-LE.yaml @@ -19,29 +19,6 @@ controls: responsibility for the contributions they make to the project, reducing the risk of intellectual property disputes against the project. group: LE - guidelines: - - reference-id: BPB - entries: - - reference-id: B-S-1 - - reference-id: CRA - entries: - - reference-id: 1.2b - - reference-id: 1.2f - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: PS.1 - - reference-id: PW.1.2 - - reference-id: PW.2.1 - - reference-id: PSSCRM - entries: - - reference-id: E3.1 - - reference-id: PCIDSS - entries: - - reference-id: 12.8.5 - - reference-id: 800-161 - entries: - - reference-id: PL-4 assessment-requirements: - id: OSPS-LE-01.01 text: | @@ -71,35 +48,6 @@ controls: and legally enforceable open source software license, providing clarity on how the code can be used and shared by others. group: LE - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-6 - - reference-id: B-B-7 - - reference-id: CRA - entries: - - reference-id: 1.2b - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: CSF - entries: - - reference-id: GV.OC-03 - - reference-id: Scorecard - entries: - - reference-id: License - - reference-id: PSSCRM - entries: - - reference-id: G1.2 - - reference-id: PCIDSS - entries: - - reference-id: 3.2.1 - - reference-id: 800-161 - entries: - - reference-id: PL-4 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: LE.01 assessment-requirements: - id: OSPS-LE-02.01 text: | @@ -142,31 +90,6 @@ controls: distributed with the appropriate license terms, making it clear to users and contributors how each can be used and shared. group: LE - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-8 - - reference-id: CRA - entries: - - reference-id: 1.2b - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: Scorecard - entries: - - reference-id: License - - reference-id: PSSCRM - entries: - - reference-id: G1.2 - - reference-id: PCIDSS - entries: - - reference-id: 3.2.1 - - reference-id: 800-161 - entries: - - reference-id: PL-4 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: LE.02 assessment-requirements: - id: OSPS-LE-03.01 text: | diff --git a/baseline/OSPS-QA.yaml b/baseline/OSPS-QA.yaml index 5c5008e6..472dc1c5 100644 --- a/baseline/OSPS-QA.yaml +++ b/baseline/OSPS-QA.yaml @@ -18,65 +18,6 @@ controls: Enable users to access and review the project's source code and history, promoting transparency and collaboration within the project community. group: QA - guidelines: - - reference-id: BPB - entries: - - reference-id: CC-B-1 - - reference-id: CC-B-2 - - reference-id: CC-B-3 - - reference-id: R-B-5 - - reference-id: CRA - entries: - - reference-id: 1.2b - - reference-id: 1.2f - - reference-id: 1.2j - - reference-id: SSDF - entries: - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: PS.3 - - reference-id: PW.1.2 - - reference-id: PW.2.1 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: 757-271 - - reference-id: CSF - entries: - - reference-id: ID.AM-02 - - reference-id: ID.RA-01 - - reference-id: ID.RA-08 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.4 - - reference-id: SLSA - entries: - - reference-id: Build platform - isolation strength - Isolated - - reference-id: PSSCRM - entries: - - reference-id: P3.5 - - reference-id: E2.2 - - reference-id: SAMM - entries: - - reference-id: Implementation -Secure Build -Build Process Lvl1 - - reference-id: PCIDSS - entries: - - reference-id: 2.1.1 - - reference-id: 6.2.1 - - reference-id: 6.5.1 - - reference-id: 6.5.2 - - reference-id: 800-161 - entries: - - reference-id: RA-5 - - reference-id: SA-11 - - reference-id: SA-15 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 2.2.3 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.02 assessment-requirements: - id: OSPS-QA-01.01 text: | @@ -114,77 +55,6 @@ controls: while enabling users and contributors to understand the software's direct dependencies. group: QA - guidelines: - - reference-id: BPB - entries: - - reference-id: Q-S-8 - - reference-id: Q-S-9 - - reference-id: CRA - entries: - - reference-id: 2.1 - - reference-id: 2.2 - - reference-id: 2.3 - - reference-id: SSDF - entries: - - reference-id: PO.3.3 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: PS.3.2 - - reference-id: PW.4 - - reference-id: CSF - entries: - - reference-id: ID.AM.01 - - reference-id: ID.AM-02 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.5 - - reference-id: 4.3.1 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: 673-475 - - reference-id: 863-521 - - reference-id: 613-286 - - reference-id: PSSCRM - entries: - - reference-id: G1.4 - - reference-id: G1.5 - - reference-id: G2.5 - - reference-id: P3.1 - - reference-id: P3.2 - - reference-id: P5.1 - - reference-id: P5.2 - - reference-id: E2.1 - - reference-id: E2.2 - - reference-id: SAMM - entries: - - reference-id: Implementation -Secure Build -Software Dependencies Lvl1 - - reference-id: PCIDSS - entries: - - reference-id: 6.3.2 - - reference-id: 6.4.3 - - reference-id: 12.5.1 - - reference-id: 800-161 - entries: - - reference-id: CA-7 - - reference-id: CM-2 - - reference-id: CM-8 - - reference-id: PL-8 - - reference-id: RA-3(1) - - reference-id: RA-5 - - reference-id: SA-11 - - reference-id: SA-15 - - reference-id: SR-3 - - reference-id: SR-4 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.2.1 - - reference-id: Claim 1.2.2 - - reference-id: Claim 3.1.1 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.01 assessment-requirements: - id: OSPS-QA-02.01 text: | @@ -220,63 +90,6 @@ controls: overlooking security vulnerabilities or defects identified by automated checks. group: QA - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2f - - reference-id: 1.2k - - reference-id: SSDF - entries: - - reference-id: PO.4.1 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: RV.1.2 - - reference-id: CSF - entries: - - reference-id: ID.IM-02 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.5 - - reference-id: OpenCRE - entries: - - reference-id: 263-184 - - reference-id: 253-452 - - reference-id: PSSCRM - entries: - - reference-id: G2.2 - - reference-id: G5.3 - - reference-id: G5.4 - - reference-id: P3.5 - - reference-id: P4.1 - - reference-id: P4.2 - - reference-id: SAMM - entries: - - reference-id: Implementation -Secure Build -Build Process Lvl3 - - reference-id: Implementation -Secure Build -Software Dependencies Lvl3 - - reference-id: Verification -Requirements Testing -Control Verification Lvl1 - - reference-id: Verification -Requirements Testing -Control Verification Lvl2 - - reference-id: Verification -Requirements Testing -Control Verification Lvl3 - - reference-id: PCIDSS - entries: - - reference-id: 6.3.1 - - reference-id: 6.3.2 - - reference-id: 6.5.2 - - reference-id: 800-161 - entries: - - reference-id: AU-6 - - reference-id: CM-3 - - reference-id: CM-6 - - reference-id: PL-8 - - reference-id: SA-11 - - reference-id: SA-15 - - reference-id: SR-3 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.3.2 - - reference-id: Claim 1.3.3 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.04 assessment-requirements: - id: OSPS-QA-03.01 text: | @@ -299,39 +112,6 @@ controls: Ensure that all codebases produced by the project are well documented and held to the same security standard. group: QA - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2b - - reference-id: 1.2f - - reference-id: SSDF - entries: - - reference-id: PO.3.2 - - reference-id: PO.4.1 - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: RV.1.2 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: SLSA - entries: - - reference-id: Build platform - isolation strength - Isolated - - reference-id: Scorecard - entries: - - reference-id: Binary-Artifacts - - reference-id: PSSCRM - entries: - - reference-id: G2.2 - - reference-id: G5.4 - - reference-id: PCIDSS - entries: - - reference-id: 6.4.2 - - reference-id: 800-161 - entries: - - reference-id: PL-8 - - reference-id: SA-15 assessment-requirements: - id: OSPS-QA-04.01 text: | @@ -369,29 +149,6 @@ controls: project's version control system, ensuring that only source code and necessary files are stored in the repository. group: QA - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2b - - reference-id: SSDF - entries: - - reference-id: PS.1 - - reference-id: PS.2 - - reference-id: OpenCRE - entries: - - reference-id: 486-813 - - reference-id: 124-564 - - reference-id: PCIDSS - entries: - - reference-id: 6.4.3 - - reference-id: 800-161 - entries: - - reference-id: PL-8 - - reference-id: SA-15 - - reference-id: SR-3 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: BR.05 assessment-requirements: - id: OSPS-QA-05.01 text: | @@ -429,62 +186,6 @@ controls: Ensure that the project uses at least one automated test suite for the source code repository and clearly documents when and how tests are run. group: QA - guidelines: - - reference-id: BPB - entries: - - reference-id: Q-B-4 - - reference-id: Q-B-8 - - reference-id: Q-B-9 - - reference-id: Q-B-10 - - reference-id: Q-S-2 - - reference-id: CRA - entries: - - reference-id: 2.3 - - reference-id: SSDF - entries: - - reference-id: PW.8.2 - - reference-id: CSF - entries: - - reference-id: ID.AM-02 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.5 - - reference-id: OpenCRE - entries: - - reference-id: 207-435 - - reference-id: 088-377 - - reference-id: Scorecard - entries: - - reference-id: CI-Tests - - reference-id: PSSCRM - entries: - - reference-id: P4.1 - - reference-id: P4.2 - - reference-id: P4.3 - - reference-id: P4.4 - - reference-id: E2.4 - - reference-id: E2.5 - - reference-id: SAMM - entries: - - reference-id: Verification-Requirements -Testing -Control Verification Lvl1 - - reference-id: Verification-Requirements -Testing -Control Verification Lvl2 - - reference-id: Verification-Requirements -Testing -Control Verification Lvl3 - - reference-id: Verification -Security Testing -Scalable Baseline Lvl3 - - reference-id: PCIDSS - entries: - - reference-id: 6.2.3 - - reference-id: 6.3.1 - - reference-id: 6.3.2 - - reference-id: 6.4.2 - - reference-id: 800-161 - entries: - - reference-id: SA-11 - - reference-id: SA-15 - - reference-id: SR-3 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.04 - - reference-id: QA.05 assessment-requirements: - id: OSPS-QA-06.01 text: | @@ -533,33 +234,6 @@ controls: non-author human approval of changes before merging into the release or primary branch. group: QA - guidelines: - - reference-id: BPB - entries: - - reference-id: B-G-3 - - reference-id: Scorecard - entries: - - reference-id: Code-Review - - reference-id: PSSCRM - entries: - - reference-id: G2.4 - - reference-id: P3.3 - - reference-id: P3.5 - - reference-id: PCIDSS - entries: - - reference-id: 6.2.3.1 - - reference-id: 6.4.2 - - reference-id: 6.5.4 - - reference-id: 800-161 - entries: - - reference-id: AC-5 - - reference-id: AU-6 - - reference-id: PL-8 - - reference-id: SA-15 - - reference-id: SR-3 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.06 assessment-requirements: - id: OSPS-QA-07.01 text: | diff --git a/baseline/OSPS-SA.yaml b/baseline/OSPS-SA.yaml index 26d98584..5ac18d8c 100644 --- a/baseline/OSPS-SA.yaml +++ b/baseline/OSPS-SA.yaml @@ -16,66 +16,6 @@ controls: security reviewers understand the internal logic of the released software assets. group: SA - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-1 - - reference-id: B-S-7 - - reference-id: B-S-8 - - reference-id: CRA - entries: - - reference-id: 1.2a - - reference-id: 1.2b - - reference-id: SSDF - entries: - - reference-id: PO.1 - - reference-id: PO.2 - - reference-id: PO.3.2 - - reference-id: CSF - entries: - - reference-id: ID.AM-02 - - reference-id: OpenCRE - entries: - - reference-id: 155-155 - - reference-id: 326-704 - - reference-id: 068-102 - - reference-id: 036-275 - - reference-id: 162-655 - - reference-id: PSSCRM - entries: - - reference-id: G5.1 - - reference-id: P1.1 - - reference-id: E3.4 - - reference-id: E3.7 - - reference-id: SAMM - entries: - - reference-id: Operations -Operational Management -Data Protection Lvl2 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 2.2.3 - - reference-id: 2.2.4 - - reference-id: 2.2.5 - - reference-id: 2.2.6 - - reference-id: 3.1.1 - - reference-id: 4.1.1 - - reference-id: 5.1.1 - - reference-id: 6.1.1 - - reference-id: 6.2.1 - - reference-id: 7.1.1 - - reference-id: 8.1.1 - - reference-id: 11.1.1 - - reference-id: 12.3.1 - - reference-id: 12.5.3 - - reference-id: 800-161 - entries: - - reference-id: CM-2 - - reference-id: PL-8 - - reference-id: RA-3 - - reference-id: SA-15 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.1.5 assessment-requirements: - id: OSPS-SA-01.01 text: | @@ -99,55 +39,6 @@ controls: the project's software and integrate it with other systems, enabling them to use the software effectively. group: SA - guidelines: - - reference-id: BPB - entries: - - reference-id: B-B-10 - - reference-id: B-S-7 - - reference-id: CRA - entries: - - reference-id: 1.2a - - reference-id: 1.2b - - reference-id: SSDF - entries: - - reference-id: PW.1.2 - - reference-id: CSF - entries: - - reference-id: GV.OC-05 - - reference-id: ID.AM-01 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.4 - - reference-id: OpenCRE - entries: - - reference-id: 155-155 - - reference-id: 068-102 - - reference-id: 072-713 - - reference-id: 820-878 - - reference-id: PSSCRM - entries: - - reference-id: E3.4 - - reference-id: E3.7 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.1 - - reference-id: 2.2.3 - - reference-id: 2.2.4 - - reference-id: 2.2.5 - - reference-id: 2.2.6 - - reference-id: 6.2.1 - - reference-id: 12.3.1 - - reference-id: 12.8.1 - - reference-id: 800-161 - entries: - - reference-id: CM-2 - - reference-id: PL-2 - - reference-id: PL-8 - - reference-id: RA-3 - - reference-id: SA-15 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.1.5 assessment-requirements: - id: OSPS-SA-02.01 text: | @@ -170,75 +61,6 @@ controls: Provide project maintainers an understanding of how the software can be misused or broken, enabling them to plan mitigations accordingly. group: SA - guidelines: - - reference-id: BPB - entries: - - reference-id: B-S-8 - - reference-id: S-G-1 - - reference-id: CRA - entries: - - reference-id: 1.1 - - reference-id: 1.2j - - reference-id: 1.2k - - reference-id: 2.2 - - reference-id: SSDF - entries: - - reference-id: PO.5.1 - - reference-id: PW.1.1 - - reference-id: CSF - entries: - - reference-id: ID.RA-01 - - reference-id: ID.RA-04 - - reference-id: ID.RA-05 - - reference-id: DE.AE-07 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.5 - - reference-id: OpenCRE - entries: - - reference-id: 068-102 - - reference-id: 154-031 - - reference-id: 888-770 - - reference-id: PSSCRM - entries: - - reference-id: G4.3 - - reference-id: G5.2 - - reference-id: P2.1 - - reference-id: SAMM - entries: - - reference-id: Governance -Create and Promote Lvl1 - - reference-id: Design -Threat Assessment -Application Risk Profile Lvl1 - - reference-id: Design -Threat Assessment -Threat Modeling Lvl1 - - reference-id: Verification -Architecture Assessment -Architecture Mitigation Lvl2 - - reference-id: PCIDSS - entries: - - reference-id: 2.2.4 - - reference-id: 2.2.5 - - reference-id: 2.2.6 - - reference-id: 6.2.1 - - reference-id: 6.2.3.1 - - reference-id: 6.3.2 - - reference-id: 6.4.2 - - reference-id: 11.3.1 - - reference-id: 12.3.1 - - reference-id: 800-161 - entries: - - reference-id: CA-2 - - reference-id: CA-2(3) - - reference-id: PM-30 - - reference-id: RA-3 - - reference-id: SA-11 - - reference-id: SA-15 - - reference-id: SA-15(3) - - reference-id: SA-15(8) - - reference-id: SI-3 - - reference-id: SR-3 - - reference-id: SR-3(3) - - reference-id: SR-6 - - reference-id: SR-7 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 1.4.1 assessment-requirements: - id: OSPS-SA-03.01 text: | diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index 46ef299c..6a705196 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -17,89 +17,6 @@ controls: project, ensuring that security issues are handled promptly and transparently. group: VM - guidelines: - - reference-id: BPB - entries: - - reference-id: R-B-6 - - reference-id: R-B-8 - - reference-id: R-S-2 - - reference-id: S-B-14 - - reference-id: S-B-15 - - reference-id: CRA - entries: - - reference-id: 2.1 - - reference-id: 2.2 - - reference-id: 2.3 - - reference-id: 2.6 - - reference-id: 2.7 - - reference-id: 2.8 - - reference-id: SSDF - entries: - - reference-id: RV.1.3 - - reference-id: CSF - entries: - - reference-id: GV.PO-01 - - reference-id: GV.PO-02 - - reference-id: ID.RA-01 - - reference-id: ID.RA-08 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.5 - - reference-id: 4.2.1 - - reference-id: 4.3.2 - - reference-id: OpenCRE - entries: - - reference-id: 887-750 - - reference-id: Scorecard - entries: - - reference-id: Security-Policy - - reference-id: PSSCRM - entries: - - reference-id: D1.1 - - reference-id: D1.2 - - reference-id: D1.3 - - reference-id: D1.5 - - reference-id: SAMM - entries: - - reference-id: Governance -Create and Promote Lvl2 - - reference-id: Governance -Policy & Compliance -Policy & Standards Lvl1 - - reference-id: Implementation -Defect Management -Defect Tracking Lvl1 - - reference-id: Implementation -Defect Management -Defect Tracking Lvl2 - - reference-id: Implementation -Defect Management -Defect Tracking Lvl3 - - reference-id: Operations -Incident Management -Incident Response Lvl1 - - reference-id: Operations -Incident Management -Incident Response Lvl2 - - reference-id: Operations -Incident Management -Incident Response Lvl3 - - reference-id: PCIDSS - entries: - - reference-id: 2.1.1 - - reference-id: 3.1.1 - - reference-id: 4.1.1 - - reference-id: 5.1.1 - - reference-id: 6.1.1 - - reference-id: 6.3.1 - - reference-id: 6.3.2 - - reference-id: 7.1.1 - - reference-id: 8.1.1 - - reference-id: 11.1.1 - - reference-id: 11.2.1 - - reference-id: 12.1.1 - - reference-id: 12.1.3 - - reference-id: 800-161 - entries: - - reference-id: IR-1 - - reference-id: IR-4 - - reference-id: IR-6 - - reference-id: IR-7(1) - - reference-id: IR-8 - - reference-id: SI-2 - - reference-id: UKSSCOP - entries: - - reference-id: Claim 3.4.1 - - reference-id: Claim 3.5.1 - - reference-id: Claim 4.1.2 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: VM.01 assessment-requirements: - id: OSPS-VM-01.01 text: | @@ -123,53 +40,6 @@ controls: should contact in the event that a vulnerability is found, and what process they should follow. group: VM - guidelines: - - reference-id: BPB - entries: - - reference-id: B-S-8 - - reference-id: CRA - entries: - - reference-id: 2.5 - - reference-id: SSDF - entries: - - reference-id: RV.1.3 - - reference-id: CSF - entries: - - reference-id: GV.PO-01 - - reference-id: GV.PO-02 - - reference-id: ID.RA-01 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.1 - - reference-id: 4.1.3 - - reference-id: 4.1.5 - - reference-id: 4.2.2 - - reference-id: OpenCRE - entries: - - reference-id: 464-513 - - reference-id: Scorecard - entries: - - reference-id: Security-Policy - - reference-id: SAMM - entries: - - reference-id: Governance -Policy&Compliance -Policy&Standards Lvl2 - - reference-id: PCIDSS - entries: - - reference-id: 6.3.3 - - reference-id: 12.1.1 - - reference-id: 12.10.2 - - reference-id: UKSSCOP - entries: - - reference-id: 3.2 - - reference-id: 800-161 - entries: - - reference-id: IR-1 - - reference-id: IR-4 - - reference-id: IR-6 - - reference-id: IR-8 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: VM.01 assessment-requirements: - id: OSPS-VM-02.01 text: | @@ -190,34 +60,6 @@ controls: public until the project has been provided time to analyze and prepare remediations to protect users of the project. group: VM - guidelines: - - reference-id: BPB - entries: - - reference-id: R-B-7 - - reference-id: CRA - entries: - - reference-id: 2.5 - - reference-id: 2.6 - - reference-id: OpenCRE - entries: - - reference-id: 308-514 - - reference-id: SAMM - entries: - - reference-id: Operations -Incident Management -Incident Response Lvl3 - - reference-id: PCIDSS - entries: - - reference-id: 6.3.1 - - reference-id: 6.3.3 - - reference-id: 12.10.2 - - reference-id: UKSSCOP - entries: - - reference-id: 3.2 - - reference-id: 800-161 - entries: - - reference-id: IR-6 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: VM.01 assessment-requirements: - id: OSPS-VM-03.01 text: | @@ -240,53 +82,6 @@ controls: Ensure that project end users have a well known mechanism to understand vulnerabilities found within the project. group: VM - guidelines: - - reference-id: CRA - entries: - - reference-id: 1.2a - - reference-id: 1.2b - - reference-id: 2.1 - - reference-id: 2.4 - - reference-id: 2.6 - - reference-id: SSDF - entries: - - reference-id: PO.4.1 - - reference-id: RV.2.1 - - reference-id: RV.2.2 - - reference-id: CSF - entries: - - reference-id: ID.RA-01 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.5 - - reference-id: PSSCRM - entries: - - reference-id: G2.2 - - reference-id: D1.1 - - reference-id: PCIDSS - entries: - - reference-id: 6.2.3 - - reference-id: 6.3.1 - - reference-id: 6.3.2 - - reference-id: 6.3.3 - - reference-id: 11.3.1 - - reference-id: UKSSCOP - entries: - - reference-id: 3.4 - - reference-id: 3.5 - - reference-id: 4.3 - - reference-id: 800-161 - entries: - - reference-id: CA-7 - - reference-id: CM-3 - - reference-id: CM-8 - - reference-id: IR-5 - - reference-id: SI-2 - - reference-id: SI-4 - - reference-id: SI-5 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: VM.02 assessment-requirements: - id: OSPS-VM-04.01 text: | @@ -323,96 +118,6 @@ controls: imported code early in the development process, reducing the risk of shipping insecure software. group: VM - guidelines: - - reference-id: BPB - entries: - - reference-id: B-S-8 - - reference-id: Q-B-12 - - reference-id: Q-S-9 - - reference-id: S-B-14 - - reference-id: S-B-15 - - reference-id: A-B-1 - - reference-id: A-B-3 - - reference-id: A-B-8 - - reference-id: A-S-1 - - reference-id: CRA - entries: - - reference-id: 1.2a - - reference-id: 1.2b - - reference-id: 1.2c - - reference-id: 2.1 - - reference-id: 2.2 - - reference-id: 2.3 - - reference-id: 2.4 - - reference-id: SSDF - entries: - - reference-id: PO.4 - - reference-id: PW.1.2 - - reference-id: PW.8.1 - - reference-id: RV.1.2 - - reference-id: RV.1.3 - - reference-id: RV.2.1 - - reference-id: RV.2.2 - - reference-id: CSF - entries: - - reference-id: GV.RM-05 - - reference-id: GV.RM-06 - - reference-id: GV.PO-01 - - reference-id: GV.PO-02 - - reference-id: ID.RA-01 - - reference-id: ID.RA-08 - - reference-id: ID.IM-02 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.5 - - reference-id: 4.2.1 - - reference-id: 4.2.2 - - reference-id: 4.3.2 - - reference-id: OpenCRE - entries: - - reference-id: 155-155 - - reference-id: 124-564 - - reference-id: 757-271 - - reference-id: 464-513 - - reference-id: 611-158 - - reference-id: 207-435 - - reference-id: 088-377 - - reference-id: Scorecard - entries: - - reference-id: Security-Policy - - reference-id: Vulnerabilities - - reference-id: PSSCRM - entries: - - reference-id: G5.4 - - reference-id: P4.1 - - reference-id: P4.2 - - reference-id: P4.3 - - reference-id: P4.4 - - reference-id: P4.5 - - reference-id: SAMM - entries: - - reference-id: Implementation -Secure Build-Build Process Lvl3 - - reference-id: Implementation -Software Dependencies Lvl3 - - reference-id: Verification -Security Testing -Scalable Baseline Lvl1 - - reference-id: Verification -Security Testing -Scalable Baseline Lvl3 - - reference-id: PCIDSS - entries: - - reference-id: 6.2.3 - - reference-id: 6.3.1 - - reference-id: 6.3.2 - - reference-id: 6.4.1 - - reference-id: 6.4.2 - - reference-id: UKSSCOP - entries: - - reference-id: 1.2 - - reference-id: 3.3 - - reference-id: 800-161 - entries: - - reference-id: CA-7 - - reference-id: RA-5 - - reference-id: SA-11 - - reference-id: SI-2 - - reference-id: SI-3 assessment-requirements: - id: OSPS-VM-05.01 text: | @@ -459,101 +164,6 @@ controls: codebase early in the development process, reducing the risk of shipping insecure software. group: VM - guidelines: - - reference-id: BPB - entries: - - reference-id: B-S-8 - - reference-id: Q-B-12 - - reference-id: Q-S-9 - - reference-id: S-B-14 - - reference-id: S-B-15 - - reference-id: A-B-1 - - reference-id: A-B-3 - - reference-id: A-B-8 - - reference-id: A-S-1 - - reference-id: CRA - entries: - - reference-id: 1.2a - - reference-id: 1.2b - - reference-id: 1.2c - - reference-id: 2.1 - - reference-id: 2.2 - - reference-id: 2.3 - - reference-id: 2.4 - - reference-id: SSDF - entries: - - reference-id: PO.4 - - reference-id: PW.1.2 - - reference-id: PW.8.1 - - reference-id: RV.1.2 - - reference-id: RV.1.3 - - reference-id: RV.2.1 - - reference-id: RV 2.2 - - reference-id: CSF - entries: - - reference-id: GV.RM-05 - - reference-id: GV.RM-06 - - reference-id: GV.PO-01 - - reference-id: GV.PO-02 - - reference-id: ID.RA-01 - - reference-id: ID.RA-08 - - reference-id: ID.IM-02 - - reference-id: ISO-18974 - entries: - - reference-id: 4.1.5 - - reference-id: 4.2.1 - - reference-id: 4.2.2 - - reference-id: 4.3.2 - - reference-id: OpenCRE - entries: - - reference-id: 155-155 - - reference-id: 124-564 - - reference-id: 757-271 - - reference-id: 464-513 - - reference-id: 611-158 - - reference-id: 207-435 - - reference-id: 088-377 - - reference-id: Scorecard - entries: - - reference-id: Security-Policy - - reference-id: Vulnerabilities - - reference-id: SAST - - reference-id: PSSCRM - entries: - - reference-id: G5.4 - - reference-id: P4.1 - - reference-id: P4.2 - - reference-id: P4.3 - - reference-id: P4.4 - - reference-id: P4.5 - - reference-id: SAMM - entries: - - reference-id: Implementation -Secure Build-Build Process Lvl3 - - reference-id: Implementation -Software Dependencies Lvl3 - - reference-id: Verification -Security Testing -Scalable Baseline Lvl1 - - reference-id: Verification -Security Testing -Scalable Baseline Lvl3 - - reference-id: PCIDSS - entries: - - reference-id: 6.2.3 - - reference-id: 6.3.1 - - reference-id: 6.3.2 - - reference-id: 6.4.1 - - reference-id: 6.4.2 - - reference-id: 6.5.2 - - reference-id: UKSSCOP - entries: - - reference-id: 1.3 - - reference-id: 1.4 - - reference-id: 800-161 - entries: - - reference-id: CA-7 - - reference-id: RA-5 - - reference-id: SA-11 - - reference-id: SI-2 - - reference-id: SI-3 - - reference-id: BSI-TR-03185-2 - entries: - - reference-id: QA.05 assessment-requirements: - id: OSPS-VM-06.01 text: | diff --git a/baseline/mappings/osps-to-800-161.yaml b/baseline/mappings/osps-to-800-161.yaml new file mode 100644 index 00000000..9f359042 --- /dev/null +++ b/baseline/mappings/osps-to-800-161.yaml @@ -0,0 +1,393 @@ +title: OSPS Baseline to NIST SP 800-161 Mapping +metadata: + id: osps-baseline-to-800-161 + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to NIST SP 800-161. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: 800-161 + title: NIST Special Publication 800-161 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations + version: "r1-upd1" + url: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf + description: This publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations. The + publication integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach, including guidance on the development + of C-SCRM strategy implementation plans, C-SCRM policies, C-SCRM plans, and risk assessments for products and services. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: 800-161 + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-800-161 + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: AC-4(21) + - entry-id: AC-17 + - entry-id: CM-5 + - entry-id: CM-6 + - entry-id: IA-2 + - entry-id: IA-5 + - id: M-OSPS-AC-02-800-161 + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: AC-2 + - entry-id: AC-3 + - entry-id: AC-4(21) + - entry-id: AC-5 + - entry-id: AC-6 + - entry-id: CM-5 + - entry-id: CM-7 + - id: M-OSPS-AC-03-800-161 + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: AC-3 + - entry-id: AC-5 + - entry-id: CM-3 + - entry-id: CM-3(2) + - entry-id: CM-5 + - id: M-OSPS-AC-04-800-161 + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: AC-3(8) + - entry-id: AC-4 + - entry-id: AC-4(6) + - entry-id: AC-6 + - entry-id: AC-20 + - entry-id: AC-20(1) + - entry-id: CM-5 + - entry-id: CM-7 + - id: M-OSPS-BR-01-800-161 + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: AC-3 + - entry-id: AC-4 + - entry-id: AC-4(21) + - entry-id: CM-5 + - entry-id: CM-7 + - entry-id: SI-7 + - id: M-OSPS-BR-02-800-161 + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: IA-4 + - entry-id: SA-15 + - entry-id: SI-7 + - entry-id: SR-4 + - id: M-OSPS-BR-03-800-161 + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: AC-4 + - entry-id: AC-4(21) + - id: M-OSPS-BR-04-800-161 + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: AU-2 + - entry-id: AU-6 + - entry-id: AU-10 + - entry-id: CM-5 + - entry-id: CM-6 + - entry-id: MA-1 + - entry-id: MA-8 + - entry-id: SI-4 + - entry-id: SI-5 + - id: M-OSPS-BR-05-800-161 + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: AC-4 + - entry-id: CM-2 + - entry-id: CM-7(4) + - entry-id: CM-7(5) + - entry-id: RA-5 + - entry-id: SA-15 + - entry-id: SR-3 + - id: M-OSPS-BR-06-800-161 + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: AU-10 + - entry-id: MP-1 + - entry-id: SA-15 + - entry-id: SI-7 + - entry-id: SI-7(14) + - id: M-OSPS-DO-01-800-161 + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: CM-2 + - entry-id: PL-2 + - entry-id: PL-8 + - entry-id: SA-15 + - id: M-OSPS-DO-02-800-161 + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: IR-6 + - entry-id: SI-4 + - entry-id: SI-5 + - id: M-OSPS-DO-03-800-161 + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: CM-2 + - entry-id: IR-1 + - entry-id: MP-1 + - entry-id: SA-15 + - entry-id: SI-7 + - entry-id: SI-7(14) + - id: M-OSPS-DO-04-800-161 + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: PL-1 + - entry-id: PL-2 + - entry-id: SI-4 + - id: M-OSPS-DO-05-800-161 + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: PL-1 + - entry-id: PL-2 + - entry-id: SI-4 + - entry-id: SI-5 + - id: M-OSPS-DO-06-800-161 + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: CA-7 + - entry-id: CM-7(5) + - entry-id: CM-8 + - entry-id: PM-30 + - entry-id: RA-3(1) + - entry-id: SA-11 + - entry-id: SI-4 + - entry-id: SR-3 + - entry-id: SR-5 + - entry-id: SR-6 + - entry-id: SR-7 + - id: M-OSPS-GV-01-800-161 + source: OSPS-GV-01 + relationship: relates-to + targets: + - entry-id: AC-2 + - entry-id: AC-3 + - entry-id: IA-2 + - entry-id: PL-1 + - entry-id: PL-4 + - entry-id: PM-30 + - id: M-OSPS-GV-02-800-161 + source: OSPS-GV-02 + relationship: relates-to + targets: + - entry-id: AC-21 + - entry-id: AU-6 + - entry-id: PL-1 + - id: M-OSPS-GV-03-800-161 + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: AC-3 + - entry-id: AC-20 + - entry-id: PL-1 + - id: M-OSPS-GV-04-800-161 + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: AC-2 + - entry-id: AC-3 + - entry-id: AC-4(21) + - entry-id: AC-5 + - entry-id: AC-6 + - entry-id: AC-20 + - entry-id: CM-7 + - entry-id: IR-4(6) + - entry-id: PM-30 + - entry-id: SI-4 + - id: M-OSPS-LE-01-800-161 + source: OSPS-LE-01 + relationship: relates-to + targets: + - entry-id: PL-4 + - id: M-OSPS-LE-02-800-161 + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: PL-4 + - id: M-OSPS-LE-03-800-161 + source: OSPS-LE-03 + relationship: relates-to + targets: + - entry-id: PL-4 + - id: M-OSPS-QA-01-800-161 + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: RA-5 + - entry-id: SA-11 + - entry-id: SA-15 + - id: M-OSPS-QA-02-800-161 + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: CA-7 + - entry-id: CM-2 + - entry-id: CM-8 + - entry-id: PL-8 + - entry-id: RA-3(1) + - entry-id: RA-5 + - entry-id: SA-11 + - entry-id: SA-15 + - entry-id: SR-3 + - entry-id: SR-4 + - id: M-OSPS-QA-03-800-161 + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: AU-6 + - entry-id: CM-3 + - entry-id: CM-6 + - entry-id: PL-8 + - entry-id: SA-11 + - entry-id: SA-15 + - entry-id: SR-3 + - id: M-OSPS-QA-04-800-161 + source: OSPS-QA-04 + relationship: relates-to + targets: + - entry-id: PL-8 + - entry-id: SA-15 + - id: M-OSPS-QA-05-800-161 + source: OSPS-QA-05 + relationship: relates-to + targets: + - entry-id: PL-8 + - entry-id: SA-15 + - entry-id: SR-3 + - id: M-OSPS-QA-06-800-161 + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: SA-11 + - entry-id: SA-15 + - entry-id: SR-3 + - id: M-OSPS-QA-07-800-161 + source: OSPS-QA-07 + relationship: relates-to + targets: + - entry-id: AC-5 + - entry-id: AU-6 + - entry-id: PL-8 + - entry-id: SA-15 + - entry-id: SR-3 + - id: M-OSPS-SA-01-800-161 + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: CM-2 + - entry-id: PL-8 + - entry-id: RA-3 + - entry-id: SA-15 + - id: M-OSPS-SA-02-800-161 + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: CM-2 + - entry-id: PL-2 + - entry-id: PL-8 + - entry-id: RA-3 + - entry-id: SA-15 + - id: M-OSPS-SA-03-800-161 + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: CA-2 + - entry-id: CA-2(3) + - entry-id: PM-30 + - entry-id: RA-3 + - entry-id: SA-11 + - entry-id: SA-15 + - entry-id: SA-15(3) + - entry-id: SA-15(8) + - entry-id: SI-3 + - entry-id: SR-3 + - entry-id: SR-3(3) + - entry-id: SR-6 + - entry-id: SR-7 + - id: M-OSPS-VM-01-800-161 + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: IR-1 + - entry-id: IR-4 + - entry-id: IR-6 + - entry-id: IR-7(1) + - entry-id: IR-8 + - entry-id: SI-2 + - id: M-OSPS-VM-02-800-161 + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: IR-1 + - entry-id: IR-4 + - entry-id: IR-6 + - entry-id: IR-8 + - id: M-OSPS-VM-03-800-161 + source: OSPS-VM-03 + relationship: relates-to + targets: + - entry-id: IR-6 + - id: M-OSPS-VM-04-800-161 + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: CA-7 + - entry-id: CM-3 + - entry-id: CM-8 + - entry-id: IR-5 + - entry-id: SI-2 + - entry-id: SI-4 + - entry-id: SI-5 + - id: M-OSPS-VM-05-800-161 + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: CA-7 + - entry-id: RA-5 + - entry-id: SA-11 + - entry-id: SI-2 + - entry-id: SI-3 + - id: M-OSPS-VM-06-800-161 + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: CA-7 + - entry-id: RA-5 + - entry-id: SA-11 + - entry-id: SI-2 + - entry-id: SI-3 diff --git a/baseline/mappings/osps-to-bpb.yaml b/baseline/mappings/osps-to-bpb.yaml new file mode 100644 index 00000000..5b5cc909 --- /dev/null +++ b/baseline/mappings/osps-to-bpb.yaml @@ -0,0 +1,244 @@ +title: OSPS Baseline to OpenSSF Best Practices Badge Mapping +metadata: + id: osps-baseline-to-bpb + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to OpenSSF Best Practices Badge. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: BPB + title: OpenSSF Best Practices Badge + version: "2024" + url: https://github.com/coreinfrastructure/best-practices-badge/blob/main/criteria/criteria.yml + description: The Open Source Security Foundation (OpenSSF) Best Practices Badge is a way for Free/Libre and Open Source Software (FLOSS) projects to show that they follow best practices. Projects + can voluntarily self-certify, at no cost, by using this web application to explain how they follow each best practice. The OpenSSF Best Practices Badge is inspired by the many badges available to + projects on GitHub. Consumers of the badge can quickly assess which FLOSS projects are following best practices and, as a result, are more likely to produce higher-quality secure software. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: BPB + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-BPB + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: CC-G-1 + - id: M-OSPS-BR-02-BPB + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: CC-B-5 + - entry-id: CC-B-6 + - entry-id: CC-B-7 + - id: M-OSPS-BR-03-BPB + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: B-B-11 + - id: M-OSPS-BR-04-BPB + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: CC-B-8 + - entry-id: CC-B-9 + - entry-id: Q-B-7 + - entry-id: A-B-1 + - entry-id: A-S-1 + - id: M-OSPS-BR-05-BPB + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: Q-B-2 + - id: M-OSPS-BR-07-BPB + source: OSPS-BR-07 + relationship: relates-to + targets: + - entry-id: S-B-5 + - id: M-OSPS-DO-01-BPB + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: B-B-1 + - entry-id: B-B-9 + - entry-id: B-S-7 + - entry-id: B-S-9 + - id: M-OSPS-DO-02-BPB + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: B-B-3 + - entry-id: R-B-1+ + - entry-id: R-B-1 + - entry-id: R-B-2 + - entry-id: R-S-2 + - id: M-OSPS-DO-03-BPB + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: CC-B-8 + - id: M-OSPS-DO-04-BPB + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: R-B-3 + - id: M-OSPS-DO-06-BPB + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: A-S-1 + - id: M-OSPS-GV-01-BPB + source: OSPS-GV-01 + relationship: relates-to + targets: + - entry-id: B-S-3 + - entry-id: B-S-4 + - id: M-OSPS-GV-02-BPB + source: OSPS-GV-02 + relationship: relates-to + targets: + - entry-id: B-B-3 + - entry-id: B-B-12 + - id: M-OSPS-GV-03-BPB + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: B-B-4 + - entry-id: B-S-3 + - entry-id: B-B-4+ + - entry-id: R-B-1 + - entry-id: Q-G-2 + - id: M-OSPS-GV-04-BPB + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: B-B-5 + - entry-id: B-S-3 + - entry-id: B-B-4+ + - entry-id: Q-G-2 + - id: M-OSPS-LE-01-BPB + source: OSPS-LE-01 + relationship: relates-to + targets: + - entry-id: B-S-1 + - id: M-OSPS-LE-02-BPB + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: B-B-6 + - entry-id: B-B-7 + - id: M-OSPS-LE-03-BPB + source: OSPS-LE-03 + relationship: relates-to + targets: + - entry-id: B-B-8 + - id: M-OSPS-QA-01-BPB + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: CC-B-1 + - entry-id: CC-B-2 + - entry-id: CC-B-3 + - entry-id: R-B-5 + - id: M-OSPS-QA-02-BPB + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: Q-S-8 + - entry-id: Q-S-9 + - id: M-OSPS-QA-06-BPB + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: Q-B-4 + - entry-id: Q-B-8 + - entry-id: Q-B-9 + - entry-id: Q-B-10 + - entry-id: Q-S-2 + - id: M-OSPS-QA-07-BPB + source: OSPS-QA-07 + relationship: relates-to + targets: + - entry-id: B-G-3 + - id: M-OSPS-SA-01-BPB + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: B-B-1 + - entry-id: B-S-7 + - entry-id: B-S-8 + - id: M-OSPS-SA-02-BPB + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: B-B-10 + - entry-id: B-S-7 + - id: M-OSPS-SA-03-BPB + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: B-S-8 + - entry-id: S-G-1 + - id: M-OSPS-VM-01-BPB + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: R-B-6 + - entry-id: R-B-8 + - entry-id: R-S-2 + - entry-id: S-B-14 + - entry-id: S-B-15 + - id: M-OSPS-VM-02-BPB + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: B-S-8 + - id: M-OSPS-VM-03-BPB + source: OSPS-VM-03 + relationship: relates-to + targets: + - entry-id: R-B-7 + - id: M-OSPS-VM-05-BPB + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: B-S-8 + - entry-id: Q-B-12 + - entry-id: Q-S-9 + - entry-id: S-B-14 + - entry-id: S-B-15 + - entry-id: A-B-1 + - entry-id: A-B-3 + - entry-id: A-B-8 + - entry-id: A-S-1 + - id: M-OSPS-VM-06-BPB + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: B-S-8 + - entry-id: Q-B-12 + - entry-id: Q-S-9 + - entry-id: S-B-14 + - entry-id: S-B-15 + - entry-id: A-B-1 + - entry-id: A-B-3 + - entry-id: A-B-8 + - entry-id: A-S-1 diff --git a/baseline/mappings/osps-to-bsi-tr-03185-2.yaml b/baseline/mappings/osps-to-bsi-tr-03185-2.yaml new file mode 100644 index 00000000..8e205c89 --- /dev/null +++ b/baseline/mappings/osps-to-bsi-tr-03185-2.yaml @@ -0,0 +1,182 @@ +title: OSPS Baseline to BSI TR-03185-2 Mapping +metadata: + id: osps-baseline-to-bsi-tr-03185-2 + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to BSI TR-03185-2. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: BSI-TR-03185-2 + title: BSI TR-03185-2 Secure Software Lifecycle for Open Source Software + version: "v1.1.0" + url: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03185/BSI-TR-03185-2.pdf?__blob=publicationFile&v=5 + description: Secure software is essential for the use of IT products in governments, businesses and societies. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: BSI-TR-03185-2 + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-BSI-TR-03185-2 + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: GV.02 + - id: M-OSPS-AC-02-BSI-TR-03185-2 + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: GV.02 + - id: M-OSPS-AC-03-BSI-TR-03185-2 + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: GV.02 + - entry-id: QA.06 + - id: M-OSPS-BR-02-BSI-TR-03185-2 + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: BR.02 + - id: M-OSPS-BR-03-BSI-TR-03185-2 + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: BR.03 + - id: M-OSPS-BR-04-BSI-TR-03185-2 + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: BR.04 + - id: M-OSPS-BR-06-BSI-TR-03185-2 + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: BR.03 + - id: M-OSPS-DO-01-BSI-TR-03185-2 + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: BR.01 + - id: M-OSPS-DO-02-BSI-TR-03185-2 + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: QA.03 + - id: M-OSPS-DO-03-BSI-TR-03185-2 + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: BR.01 + - entry-id: BR.03 + - id: M-OSPS-DO-04-BSI-TR-03185-2 + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: DE.01 + - id: M-OSPS-DO-05-BSI-TR-03185-2 + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: DE.01 + - id: M-OSPS-DO-06-BSI-TR-03185-2 + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: QA.01 + - id: M-OSPS-GV-02-BSI-TR-03185-2 + source: OSPS-GV-02 + relationship: relates-to + targets: + - entry-id: QA.03 + - id: M-OSPS-GV-03-BSI-TR-03185-2 + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: GV.01 + - entry-id: QA.04 + - entry-id: QA.05 + - id: M-OSPS-LE-02-BSI-TR-03185-2 + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: LE.01 + - id: M-OSPS-LE-03-BSI-TR-03185-2 + source: OSPS-LE-03 + relationship: relates-to + targets: + - entry-id: LE.02 + - id: M-OSPS-QA-01-BSI-TR-03185-2 + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: QA.02 + - id: M-OSPS-QA-02-BSI-TR-03185-2 + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: QA.01 + - id: M-OSPS-QA-03-BSI-TR-03185-2 + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: QA.04 + - id: M-OSPS-QA-05-BSI-TR-03185-2 + source: OSPS-QA-05 + relationship: relates-to + targets: + - entry-id: BR.05 + - id: M-OSPS-QA-06-BSI-TR-03185-2 + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: QA.04 + - entry-id: QA.05 + - id: M-OSPS-QA-07-BSI-TR-03185-2 + source: OSPS-QA-07 + relationship: relates-to + targets: + - entry-id: QA.06 + - id: M-OSPS-VM-01-BSI-TR-03185-2 + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: VM.01 + - id: M-OSPS-VM-02-BSI-TR-03185-2 + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: VM.01 + - id: M-OSPS-VM-03-BSI-TR-03185-2 + source: OSPS-VM-03 + relationship: relates-to + targets: + - entry-id: VM.01 + - id: M-OSPS-VM-04-BSI-TR-03185-2 + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: VM.02 + - id: M-OSPS-VM-06-BSI-TR-03185-2 + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: QA.05 diff --git a/baseline/mappings/osps-to-cra.yaml b/baseline/mappings/osps-to-cra.yaml new file mode 100644 index 00000000..0d7ce1af --- /dev/null +++ b/baseline/mappings/osps-to-cra.yaml @@ -0,0 +1,285 @@ +title: OSPS Baseline to EU Cyber Resilience Act Mapping +metadata: + id: osps-baseline-to-cra + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to EU Cyber Resilience Act. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: CRA + title: Cyber Resilience Act + version: "20.11.2024" + url: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#tit_1 + description: Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations + (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) (Text with EEA relevance) +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: CRA + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-CRA + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: 1.2d + - entry-id: 1.2e + - entry-id: 1.2f + - id: M-OSPS-AC-02-CRA + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: 1.2f + - id: M-OSPS-AC-03-CRA + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: 1.2f + - id: M-OSPS-AC-04-CRA + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: 1.2d + - entry-id: 1.2e + - entry-id: 1.2f + - id: M-OSPS-BR-01-CRA + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: 1.2f + - id: M-OSPS-BR-02-CRA + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: 1.2f + - id: M-OSPS-BR-03-CRA + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: 1.2d + - entry-id: 1.2e + - entry-id: 1.2f + - entry-id: 1.2i + - entry-id: 1.2j + - entry-id: 1.2k + - id: M-OSPS-BR-04-CRA + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: 1.2d + - entry-id: 1.2f + - entry-id: 1.2h + - entry-id: 1.2j + - entry-id: 1.2l + - entry-id: '2.5' + - id: M-OSPS-BR-05-CRA + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: 1.2b + - entry-id: 1.2d + - entry-id: 1.2f + - entry-id: 1.2h + - entry-id: 1.2j + - entry-id: '2.1' + - entry-id: '2.2' + - entry-id: '2.3' + - id: M-OSPS-DO-01-CRA + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: 1.2b + - entry-id: 1.2j + - entry-id: 1.2k + - id: M-OSPS-DO-02-CRA + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: 1.2c + - entry-id: 1.2l + - entry-id: '2.1' + - entry-id: '2.2' + - entry-id: '2.5' + - entry-id: '2.6' + - id: M-OSPS-DO-03-CRA + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: 1.2d + - id: M-OSPS-DO-05-CRA + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: 1.2c + - entry-id: '2.6' + - id: M-OSPS-DO-06-CRA + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: '2.1' + - id: M-OSPS-GV-02-CRA + source: OSPS-GV-02 + relationship: relates-to + targets: + - entry-id: 1.2l + - entry-id: '2.3' + - entry-id: '2.4' + - entry-id: '2.6' + - id: M-OSPS-GV-03-CRA + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: 1.2l + - entry-id: '2.4' + - id: M-OSPS-GV-04-CRA + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: 1.2d + - entry-id: 1.2l + - entry-id: '2.1' + - entry-id: '2.2' + - entry-id: '2.5' + - entry-id: '2.6' + - id: M-OSPS-LE-01-CRA + source: OSPS-LE-01 + relationship: relates-to + targets: + - entry-id: 1.2b + - entry-id: 1.2f + - id: M-OSPS-LE-02-CRA + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: 1.2b + - id: M-OSPS-LE-03-CRA + source: OSPS-LE-03 + relationship: relates-to + targets: + - entry-id: 1.2b + - id: M-OSPS-QA-01-CRA + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: 1.2b + - entry-id: 1.2f + - entry-id: 1.2j + - id: M-OSPS-QA-02-CRA + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: '2.1' + - entry-id: '2.2' + - entry-id: '2.3' + - id: M-OSPS-QA-03-CRA + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: 1.2f + - entry-id: 1.2k + - id: M-OSPS-QA-04-CRA + source: OSPS-QA-04 + relationship: relates-to + targets: + - entry-id: 1.2b + - entry-id: 1.2f + - id: M-OSPS-QA-05-CRA + source: OSPS-QA-05 + relationship: relates-to + targets: + - entry-id: 1.2b + - id: M-OSPS-QA-06-CRA + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: '2.3' + - id: M-OSPS-SA-01-CRA + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: 1.2a + - entry-id: 1.2b + - id: M-OSPS-SA-02-CRA + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: 1.2a + - entry-id: 1.2b + - id: M-OSPS-SA-03-CRA + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: '1.1' + - entry-id: 1.2j + - entry-id: 1.2k + - entry-id: '2.2' + - id: M-OSPS-VM-01-CRA + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: '2.1' + - entry-id: '2.2' + - entry-id: '2.3' + - entry-id: '2.6' + - entry-id: '2.7' + - entry-id: '2.8' + - id: M-OSPS-VM-02-CRA + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: '2.5' + - id: M-OSPS-VM-03-CRA + source: OSPS-VM-03 + relationship: relates-to + targets: + - entry-id: '2.5' + - entry-id: '2.6' + - id: M-OSPS-VM-04-CRA + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: 1.2a + - entry-id: 1.2b + - entry-id: '2.1' + - entry-id: '2.4' + - entry-id: '2.6' + - id: M-OSPS-VM-05-CRA + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: 1.2a + - entry-id: 1.2b + - entry-id: 1.2c + - entry-id: '2.1' + - entry-id: '2.2' + - entry-id: '2.3' + - entry-id: '2.4' + - id: M-OSPS-VM-06-CRA + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: 1.2a + - entry-id: 1.2b + - entry-id: 1.2c + - entry-id: '2.1' + - entry-id: '2.2' + - entry-id: '2.3' + - entry-id: '2.4' diff --git a/baseline/mappings/osps-to-csf.yaml b/baseline/mappings/osps-to-csf.yaml new file mode 100644 index 00000000..04cc2cac --- /dev/null +++ b/baseline/mappings/osps-to-csf.yaml @@ -0,0 +1,175 @@ +title: OSPS Baseline to NIST CSF 2.0 Mapping +metadata: + id: osps-baseline-to-csf + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to NIST CSF 2.0. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: CSF + title: NIST Cybersecurity Framework + version: "2.0" + url: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf + description: The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks. It offers a taxonomy of high level + cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity — to better understand, assess, prioritize, and communicate its cybersecurity efforts. The + CSF does not prescribe how outcomes should be achieved. Rather, it links to online resources that provide additional guidance on practices and controls that could be used to achieve those outcomes. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: CSF + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-CSF + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: PR.AA-02 + - entry-id: PR.AA-05 + - id: M-OSPS-AC-02-CSF + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: PR.AA-02 + - entry-id: PR.AA-05 + - id: M-OSPS-AC-03-CSF + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: PR.AA-02 + - entry-id: PR.AA-05 + - id: M-OSPS-AC-04-CSF + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: PR.AA-02 + - entry-id: PR.AA-05 + - id: M-OSPS-BR-01-CSF + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: PR.AA-02 + - id: M-OSPS-DO-01-CSF + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: GV.OC-04 + - entry-id: GV.OC-05 + - id: M-OSPS-DO-02-CSF + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: RS.MA-02 + - entry-id: GV.RM-05 + - id: M-OSPS-GV-04-CSF + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: PR.AA-02 + - entry-id: PR.AA-05 + - id: M-OSPS-LE-02-CSF + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: GV.OC-03 + - id: M-OSPS-QA-01-CSF + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: ID.AM-02 + - entry-id: ID.RA-01 + - entry-id: ID.RA-08 + - id: M-OSPS-QA-02-CSF + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: ID.AM-01 + - entry-id: ID.AM-02 + - id: M-OSPS-QA-03-CSF + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: ID.IM-02 + - id: M-OSPS-QA-06-CSF + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: ID.AM-02 + - id: M-OSPS-SA-01-CSF + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: ID.AM-02 + - id: M-OSPS-SA-02-CSF + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: GV.OC-05 + - entry-id: ID.AM-01 + - id: M-OSPS-SA-03-CSF + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: ID.RA-01 + - entry-id: ID.RA-04 + - entry-id: ID.RA-05 + - entry-id: DE.AE-07 + - id: M-OSPS-VM-01-CSF + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: GV.PO-01 + - entry-id: GV.PO-02 + - entry-id: ID.RA-01 + - entry-id: ID.RA-08 + - id: M-OSPS-VM-02-CSF + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: GV.PO-01 + - entry-id: GV.PO-02 + - entry-id: ID.RA-01 + - id: M-OSPS-VM-04-CSF + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: ID.RA-01 + - id: M-OSPS-VM-05-CSF + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: GV.RM-05 + - entry-id: GV.RM-06 + - entry-id: GV.PO-01 + - entry-id: GV.PO-02 + - entry-id: ID.RA-01 + - entry-id: ID.RA-08 + - entry-id: ID.IM-02 + - id: M-OSPS-VM-06-CSF + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: GV.RM-05 + - entry-id: GV.RM-06 + - entry-id: GV.PO-01 + - entry-id: GV.PO-02 + - entry-id: ID.RA-01 + - entry-id: ID.RA-08 + - entry-id: ID.IM-02 diff --git a/baseline/mappings/osps-to-iso-18974.yaml b/baseline/mappings/osps-to-iso-18974.yaml new file mode 100644 index 00000000..13e96c92 --- /dev/null +++ b/baseline/mappings/osps-to-iso-18974.yaml @@ -0,0 +1,138 @@ +title: OSPS Baseline to ISO/IEC 18974 Mapping +metadata: + id: osps-baseline-to-iso-18974 + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to ISO/IEC 18974. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: ISO-18974 + title: ISO/IEC 18974 + version: "1.0 - 2023-12" + url: https://openchainproject.org/security-assurance + description: 'ISO/IEC 18974 helps organizations check open source for known security vulnerability issues like CVEs, GitHub dependency alerts or package manager alerts. ISO/IEC 18974 identifies: The + key places to have security processes, How to assign roles and responsibilities, And how to ensure sustainability of the processes. ISO/IEC 18974 is lightweight, easy to read and is supported by + our global community with free reference material and conformance resources.' +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: ISO-18974 + entry-type: Guideline +mappings: + - id: M-OSPS-DO-01-ISO-18974 + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: 4.1.4 + - id: M-OSPS-DO-02-ISO-18974 + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: 4.2.1 + - id: M-OSPS-DO-04-ISO-18974 + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: '4.1' + - entry-id: 4.3.1 + - id: M-OSPS-DO-05-ISO-18974 + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: 4.1.1 + - entry-id: 4.3.1 + - id: M-OSPS-GV-03-ISO-18974 + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: 4.1.2 + - id: M-OSPS-GV-04-ISO-18974 + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: 4.1.2 + - id: M-OSPS-QA-01-ISO-18974 + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: 4.1.4 + - id: M-OSPS-QA-02-ISO-18974 + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: 4.1.5 + - entry-id: 4.3.1 + - id: M-OSPS-QA-03-ISO-18974 + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: 4.1.5 + - id: M-OSPS-QA-06-ISO-18974 + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: 4.1.5 + - id: M-OSPS-SA-02-ISO-18974 + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: 4.1.4 + - id: M-OSPS-SA-03-ISO-18974 + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: 4.1.5 + - id: M-OSPS-VM-01-ISO-18974 + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: 4.1.5 + - entry-id: 4.2.1 + - entry-id: 4.3.2 + - id: M-OSPS-VM-02-ISO-18974 + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: 4.1.1 + - entry-id: 4.1.3 + - entry-id: 4.1.5 + - entry-id: 4.2.2 + - id: M-OSPS-VM-04-ISO-18974 + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: 4.1.5 + - id: M-OSPS-VM-05-ISO-18974 + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: 4.1.5 + - entry-id: 4.2.1 + - entry-id: 4.2.2 + - entry-id: 4.3.2 + - id: M-OSPS-VM-06-ISO-18974 + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: 4.1.5 + - entry-id: 4.2.1 + - entry-id: 4.2.2 + - entry-id: 4.3.2 diff --git a/baseline/mappings/osps-to-opencre.yaml b/baseline/mappings/osps-to-opencre.yaml new file mode 100644 index 00000000..8d37920e --- /dev/null +++ b/baseline/mappings/osps-to-opencre.yaml @@ -0,0 +1,248 @@ +title: OSPS Baseline to OpenCRE Mapping +metadata: + id: osps-baseline-to-opencre + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to OpenCRE. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: OpenCRE + title: Open Cybersecurity Reference Architecture + version: "2024" + url: https://github.com/OWASP/OpenCRE + description: OpenCRE stands for Open Common Requirement enumeration. It is an interactive content linking platform for uniting security standards and guidelines. It offers easy and robust access to + relevant information when designing, developing, testing and procuring secure software. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: OpenCRE + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-OpenCRE + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 347-352 + - entry-id: 333-858 + - entry-id: 152-725 + - entry-id: 201-246 + - id: M-OSPS-AC-02-OpenCRE + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 802-056 + - entry-id: 368-633 + - entry-id: 152-725 + - id: M-OSPS-AC-03-OpenCRE + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 152-725 + - id: M-OSPS-AC-04-OpenCRE + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 347-507 + - entry-id: 263-184 + - entry-id: 123-124 + - id: M-OSPS-BR-01-OpenCRE + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 347-352 + - id: M-OSPS-BR-02-OpenCRE + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - id: M-OSPS-BR-03-OpenCRE + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 263-184 + - id: M-OSPS-BR-04-OpenCRE + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 068-486 + - entry-id: 124-564 + - entry-id: 757-271 + - entry-id: 347-352 + - entry-id: 263-184 + - entry-id: 208-355 + - entry-id: 745-356 + - entry-id: 732-148 + - id: M-OSPS-BR-05-OpenCRE + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 347-352 + - entry-id: 715-334 + - id: M-OSPS-DO-01-OpenCRE + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: 036-275 + - id: M-OSPS-DO-03-OpenCRE + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: 171-222 + - id: M-OSPS-DO-05-OpenCRE + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: 673-475 + - entry-id: 053-751 + - id: M-OSPS-DO-06-OpenCRE + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: 613-286 + - entry-id: 053-751 + - id: M-OSPS-GV-01-OpenCRE + source: OSPS-GV-01 + relationship: relates-to + targets: + - entry-id: 013-021 + - id: M-OSPS-GV-04-OpenCRE + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: 123-124 + - entry-id: 152-725 + - id: M-OSPS-QA-01-OpenCRE + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 757-271 + - id: M-OSPS-QA-02-OpenCRE + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - entry-id: 673-475 + - entry-id: 863-521 + - entry-id: 613-286 + - id: M-OSPS-QA-03-OpenCRE + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: 263-184 + - entry-id: 253-452 + - id: M-OSPS-QA-04-OpenCRE + source: OSPS-QA-04 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - id: M-OSPS-QA-05-OpenCRE + source: OSPS-QA-05 + relationship: relates-to + targets: + - entry-id: 486-813 + - entry-id: 124-564 + - id: M-OSPS-QA-06-OpenCRE + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: 207-435 + - entry-id: 088-377 + - id: M-OSPS-SA-01-OpenCRE + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: 155-155 + - entry-id: 326-704 + - entry-id: 068-102 + - entry-id: 036-275 + - entry-id: 162-655 + - id: M-OSPS-SA-02-OpenCRE + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: 155-155 + - entry-id: 068-102 + - entry-id: 072-713 + - entry-id: 820-878 + - id: M-OSPS-SA-03-OpenCRE + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: 068-102 + - entry-id: 154-031 + - entry-id: 888-770 + - id: M-OSPS-VM-01-OpenCRE + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: 887-750 + - id: M-OSPS-VM-02-OpenCRE + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: 464-513 + - id: M-OSPS-VM-03-OpenCRE + source: OSPS-VM-03 + relationship: relates-to + targets: + - entry-id: 308-514 + - id: M-OSPS-VM-05-OpenCRE + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: 155-155 + - entry-id: 124-564 + - entry-id: 757-271 + - entry-id: 464-513 + - entry-id: 611-158 + - entry-id: 207-435 + - entry-id: 088-377 + - id: M-OSPS-VM-06-OpenCRE + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: 155-155 + - entry-id: 124-564 + - entry-id: 757-271 + - entry-id: 464-513 + - entry-id: 611-158 + - entry-id: 207-435 + - entry-id: 088-377 diff --git a/baseline/mappings/osps-to-pcidss.yaml b/baseline/mappings/osps-to-pcidss.yaml new file mode 100644 index 00000000..49cb2649 --- /dev/null +++ b/baseline/mappings/osps-to-pcidss.yaml @@ -0,0 +1,397 @@ +title: OSPS Baseline to PCI DSS Mapping +metadata: + id: osps-baseline-to-pcidss + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to PCI DSS. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: PCIDSS + title: Payment Card Industry Data Security Standard + version: "4.0.1" + url: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf + description: 'PCI Security Standards are technical and operational requirements set by the PCI Security Standards Council (PCI SSC) to protect cardholder data. The standards apply to all entities + that store, process or transmit cardholder data – with requirements for software developers and manufacturers of applications and devices used in those transactions. The Council is responsible for + managing the security standards, while compliance with the PCI set of standards is enforced by the founding members of the Council: American Express, Discover Financial Services, JCB, MasterCard + and Visa Inc. The PCI Data Security Standard (PCI DSS) applies to all entities that store, process, and/or transmit cardholder data. It covers technical and operational system components included + in or connected to cardholder data. If you accept or process payment cards, PCI DSS applies to you.' +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: PCIDSS + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-PCIDSS + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - entry-id: 8.2.1 + - entry-id: 8.3.1 + - id: M-OSPS-AC-02-PCIDSS + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - id: M-OSPS-AC-03-PCIDSS + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - id: M-OSPS-AC-04-PCIDSS + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - entry-id: 8.2.1 + - id: M-OSPS-BR-01-PCIDSS + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - entry-id: 6.4.1 + - id: M-OSPS-BR-02-PCIDSS + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: 6.4.3 + - id: M-OSPS-BR-03-PCIDSS + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - entry-id: 2.2.7 + - entry-id: 4.2.1 + - entry-id: 4.2.2 + - entry-id: 6.4.1 + - entry-id: 8.3.2 + - id: M-OSPS-BR-04-PCIDSS + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: 6.2.1 + - entry-id: 6.4.1 + - entry-id: 6.5.1 + - entry-id: 6.5.2 + - entry-id: 10.2.2 + - id: M-OSPS-BR-05-PCIDSS + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: 6.4.3 + - id: M-OSPS-BR-06-PCIDSS + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - entry-id: 2.2.7 + - entry-id: 3.5.1 + - entry-id: 4.2.1 + - entry-id: 4.2.2 + - entry-id: 6.4.1 + - entry-id: 8.3.2 + - id: M-OSPS-DO-01-PCIDSS + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: 2.1.1 + - entry-id: 2.2.1 + - entry-id: 3.1.1 + - entry-id: 4.1.1 + - entry-id: 5.1.1 + - entry-id: 6.1.1 + - entry-id: 6.2.1 + - entry-id: 7.1.1 + - entry-id: 8.1.1 + - entry-id: 11.1.1 + - entry-id: 12.10.5 + - id: M-OSPS-DO-02-PCIDSS + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: 6.3.2 + - entry-id: 6.3.3 + - entry-id: 6.5.1 + - entry-id: 6.5.2 + - entry-id: 12.10.2 + - id: M-OSPS-DO-03-PCIDSS + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: 3.1.1 + - entry-id: 3.5.1 + - entry-id: 4.1.1 + - entry-id: 5.1.1 + - entry-id: 6.1.1 + - entry-id: 6.2.1 + - entry-id: 7.1.1 + - entry-id: 8.1.1 + - entry-id: 11.1.1 + - id: M-OSPS-DO-04-PCIDSS + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: 2.1.1 + - entry-id: 3.1.1 + - entry-id: 3.2.1 + - entry-id: 4.1.1 + - entry-id: 5.1.1 + - entry-id: 6.1.1 + - entry-id: 6.3.3 + - entry-id: 7.1.1 + - entry-id: 8.1.1 + - entry-id: 11.1.1 + - id: M-OSPS-DO-05-PCIDSS + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: 3.1.1 + - entry-id: 3.2.1 + - entry-id: 4.1.1 + - entry-id: 5.1.1 + - entry-id: 6.1.1 + - entry-id: 6.3.2 + - entry-id: 7.1.1 + - entry-id: 8.1.1 + - entry-id: 11.1.1 + - id: M-OSPS-DO-06-PCIDSS + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: 2.1.1 + - entry-id: 3.1.1 + - entry-id: 4.1.1 + - entry-id: 5.1.1 + - entry-id: 6.1.1 + - entry-id: 6.3.2 + - entry-id: 6.4.3 + - entry-id: 7.1.1 + - entry-id: 8.1.1 + - entry-id: 11.1.1 + - entry-id: 12.5.2 + - id: M-OSPS-GV-01-PCIDSS + source: OSPS-GV-01 + relationship: relates-to + targets: + - entry-id: 2.1.2 + - entry-id: 3.1.1 + - entry-id: 3.1.2 + - entry-id: 4.1.1 + - entry-id: 4.1.2 + - entry-id: 5.1.1 + - entry-id: 5.1.2 + - entry-id: 6.1.1 + - entry-id: 6.1.2 + - entry-id: 6.5.4 + - entry-id: 7.1.1 + - entry-id: 7.1.2 + - entry-id: 8.1.1 + - entry-id: 8.1.2 + - entry-id: 11.1.1 + - entry-id: 11.1.2 + - entry-id: 12.1.3 + - entry-id: 12.5.2 + - id: M-OSPS-GV-02-PCIDSS + source: OSPS-GV-02 + relationship: relates-to + targets: + - entry-id: 12.5.2 + - id: M-OSPS-GV-03-PCIDSS + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: 2.1.1 + - entry-id: 6.5.4 + - entry-id: 8.2.1 + - entry-id: 12.5.2 + - id: M-OSPS-GV-04-PCIDSS + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: 2.1.1 + - entry-id: 6.5.4 + - entry-id: 8.2.1 + - entry-id: 8.2.2 + - id: M-OSPS-LE-01-PCIDSS + source: OSPS-LE-01 + relationship: relates-to + targets: + - entry-id: 12.8.5 + - id: M-OSPS-LE-02-PCIDSS + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: 3.2.1 + - id: M-OSPS-LE-03-PCIDSS + source: OSPS-LE-03 + relationship: relates-to + targets: + - entry-id: 3.2.1 + - id: M-OSPS-QA-01-PCIDSS + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: 2.1.1 + - entry-id: 6.2.1 + - entry-id: 6.5.1 + - entry-id: 6.5.2 + - id: M-OSPS-QA-02-PCIDSS + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: 6.3.2 + - entry-id: 6.4.3 + - entry-id: 12.5.1 + - id: M-OSPS-QA-03-PCIDSS + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: 6.3.1 + - entry-id: 6.3.2 + - entry-id: 6.5.2 + - id: M-OSPS-QA-04-PCIDSS + source: OSPS-QA-04 + relationship: relates-to + targets: + - entry-id: 6.4.2 + - id: M-OSPS-QA-05-PCIDSS + source: OSPS-QA-05 + relationship: relates-to + targets: + - entry-id: 6.4.3 + - id: M-OSPS-QA-06-PCIDSS + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: 6.2.3 + - entry-id: 6.3.1 + - entry-id: 6.3.2 + - entry-id: 6.4.2 + - id: M-OSPS-QA-07-PCIDSS + source: OSPS-QA-07 + relationship: relates-to + targets: + - entry-id: 6.2.3.1 + - entry-id: 6.4.2 + - entry-id: 6.5.4 + - id: M-OSPS-SA-01-PCIDSS + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - entry-id: 2.2.3 + - entry-id: 2.2.4 + - entry-id: 2.2.5 + - entry-id: 2.2.6 + - entry-id: 3.1.1 + - entry-id: 4.1.1 + - entry-id: 5.1.1 + - entry-id: 6.1.1 + - entry-id: 6.2.1 + - entry-id: 7.1.1 + - entry-id: 8.1.1 + - entry-id: 11.1.1 + - entry-id: 12.3.1 + - entry-id: 12.5.3 + - id: M-OSPS-SA-02-PCIDSS + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: 2.2.1 + - entry-id: 2.2.3 + - entry-id: 2.2.4 + - entry-id: 2.2.5 + - entry-id: 2.2.6 + - entry-id: 6.2.1 + - entry-id: 12.3.1 + - entry-id: 12.8.1 + - id: M-OSPS-SA-03-PCIDSS + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: 2.2.4 + - entry-id: 2.2.5 + - entry-id: 2.2.6 + - entry-id: 6.2.1 + - entry-id: 6.2.3.1 + - entry-id: 6.3.2 + - entry-id: 6.4.2 + - entry-id: 11.3.1 + - entry-id: 12.3.1 + - id: M-OSPS-VM-01-PCIDSS + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: 2.1.1 + - entry-id: 3.1.1 + - entry-id: 4.1.1 + - entry-id: 5.1.1 + - entry-id: 6.1.1 + - entry-id: 6.3.1 + - entry-id: 6.3.2 + - entry-id: 7.1.1 + - entry-id: 8.1.1 + - entry-id: 11.1.1 + - entry-id: 11.2.1 + - entry-id: 12.1.1 + - entry-id: 12.1.3 + - id: M-OSPS-VM-02-PCIDSS + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: 6.3.3 + - entry-id: 12.1.1 + - entry-id: 12.10.2 + - id: M-OSPS-VM-03-PCIDSS + source: OSPS-VM-03 + relationship: relates-to + targets: + - entry-id: 6.3.1 + - entry-id: 6.3.3 + - entry-id: 12.10.2 + - id: M-OSPS-VM-04-PCIDSS + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: 6.2.3 + - entry-id: 6.3.1 + - entry-id: 6.3.2 + - entry-id: 6.3.3 + - entry-id: 11.3.1 + - id: M-OSPS-VM-05-PCIDSS + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: 6.2.3 + - entry-id: 6.3.1 + - entry-id: 6.3.2 + - entry-id: 6.4.1 + - entry-id: 6.4.2 + - id: M-OSPS-VM-06-PCIDSS + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: 6.2.3 + - entry-id: 6.3.1 + - entry-id: 6.3.2 + - entry-id: 6.4.1 + - entry-id: 6.4.2 + - entry-id: 6.5.2 diff --git a/baseline/mappings/osps-to-psscrm.yaml b/baseline/mappings/osps-to-psscrm.yaml new file mode 100644 index 00000000..0ce36771 --- /dev/null +++ b/baseline/mappings/osps-to-psscrm.yaml @@ -0,0 +1,304 @@ +title: OSPS Baseline to P-SSCRM Mapping +metadata: + id: osps-baseline-to-psscrm + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to P-SSCRM. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: PSSCRM + title: Proactive Software Supply Chain Risk Management Framework + version: "1.0" + url: https://arxiv.org/pdf/2404.12300 + description: The Proactive-Software Supply Chain Risk Management (P-SSCRM) Framework is designed to help you understand and plan a secure software supply chain risk management initiative. P-SSCRM + was created through a process of understanding and analyzing real-world data from nine industry-leading software supply chain risk management initiatives as well as through the analysis and unification + of ten government and industry documents, frameworks, and standards. Although individual methodologies and standards differ, many initiatives and standards share common ground. P-SSCRM describes + this common ground and presents a model for understanding, quantifying, and developing a secure software supply chain risk management program and determining where your organization’s existing efforts + stand when contrasted with other real-world software supply chain risk management initiatives. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: PSSCRM + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-PSSCRM + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: G2.6 + - entry-id: P3.3 + - entry-id: E1.2 + - entry-id: E1.3 + - entry-id: E1.4 + - entry-id: E3.1 + - id: M-OSPS-AC-02-PSSCRM + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: P2.3 + - entry-id: E1.2 + - entry-id: E3.3 + - id: M-OSPS-AC-03-PSSCRM + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: P3.2 + - entry-id: P3.5 + - entry-id: E1.5 + - entry-id: E3.1 + - id: M-OSPS-AC-04-PSSCRM + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: P3.2 + - id: M-OSPS-BR-01-PSSCRM + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: P2.3 + - entry-id: P3.2 + - entry-id: P3.5 + - entry-id: E2.4 + - entry-id: E2.5 + - entry-id: D2.2 + - id: M-OSPS-BR-02-PSSCRM + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: G1.4 + - entry-id: E1.2 + - entry-id: E2.1 + - entry-id: E2.6 + - id: M-OSPS-BR-03-PSSCRM + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: E1.1 + - entry-id: E2.2 + - entry-id: E2.4 + - entry-id: E2.5 + - id: M-OSPS-BR-04-PSSCRM + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: G1.4 + - entry-id: E2.1 + - entry-id: E2.4 + - entry-id: E2.5 + - entry-id: E3.1 + - entry-id: E3.6 + - id: M-OSPS-BR-05-PSSCRM + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: P3.1 + - entry-id: P3.5 + - entry-id: E2.2 + - entry-id: E2.3 + - entry-id: E2.4 + - entry-id: E2.5 + - id: M-OSPS-BR-06-PSSCRM + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: P1.2 + - entry-id: P3.2 + - entry-id: P3.3 + - entry-id: E2.1 + - entry-id: E2.2 + - entry-id: E2.6 + - id: M-OSPS-DO-01-PSSCRM + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: G5.1 + - entry-id: E3.5 + - id: M-OSPS-DO-03-PSSCRM + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: G1.3 + - entry-id: G2.5 + - entry-id: P1.2 + - entry-id: P3.1 + - entry-id: P3.2 + - entry-id: P3.3 + - entry-id: E2.6 + - id: M-OSPS-DO-04-PSSCRM + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: E1.6 + - id: M-OSPS-DO-05-PSSCRM + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: E1.6 + - id: M-OSPS-DO-06-PSSCRM + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: G1.4 + - entry-id: G2.4 + - entry-id: P3.1 + - entry-id: P3.2 + - entry-id: P3.4 + - id: M-OSPS-GV-01-PSSCRM + source: OSPS-GV-01 + relationship: relates-to + targets: + - entry-id: G2.3 + - entry-id: E3.1 + - entry-id: E3.3 + - id: M-OSPS-GV-03-PSSCRM + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: G2.4 + - entry-id: P2.2 + - id: M-OSPS-GV-04-PSSCRM + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: E3.1 + - entry-id: E3.3 + - id: M-OSPS-LE-01-PSSCRM + source: OSPS-LE-01 + relationship: relates-to + targets: + - entry-id: E3.1 + - id: M-OSPS-LE-02-PSSCRM + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: G1.2 + - id: M-OSPS-LE-03-PSSCRM + source: OSPS-LE-03 + relationship: relates-to + targets: + - entry-id: G1.2 + - id: M-OSPS-QA-01-PSSCRM + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: P3.5 + - entry-id: E2.2 + - id: M-OSPS-QA-02-PSSCRM + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: G1.4 + - entry-id: G1.5 + - entry-id: G2.5 + - entry-id: P3.1 + - entry-id: P3.2 + - entry-id: P5.1 + - entry-id: P5.2 + - entry-id: E2.1 + - entry-id: E2.2 + - id: M-OSPS-QA-03-PSSCRM + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: G2.2 + - entry-id: G5.3 + - entry-id: G5.4 + - entry-id: P3.5 + - entry-id: P4.1 + - entry-id: P4.2 + - id: M-OSPS-QA-04-PSSCRM + source: OSPS-QA-04 + relationship: relates-to + targets: + - entry-id: G2.2 + - entry-id: G5.4 + - id: M-OSPS-QA-06-PSSCRM + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: P4.1 + - entry-id: P4.2 + - entry-id: P4.3 + - entry-id: P4.4 + - entry-id: E2.4 + - entry-id: E2.5 + - id: M-OSPS-QA-07-PSSCRM + source: OSPS-QA-07 + relationship: relates-to + targets: + - entry-id: G2.4 + - entry-id: P3.3 + - entry-id: P3.5 + - id: M-OSPS-SA-01-PSSCRM + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: G5.1 + - entry-id: P1.1 + - entry-id: E3.4 + - entry-id: E3.7 + - id: M-OSPS-SA-02-PSSCRM + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: E3.4 + - entry-id: E3.7 + - id: M-OSPS-SA-03-PSSCRM + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: G4.3 + - entry-id: G5.2 + - entry-id: P2.1 + - id: M-OSPS-VM-01-PSSCRM + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: D1.1 + - entry-id: D1.2 + - entry-id: D1.3 + - entry-id: D1.5 + - id: M-OSPS-VM-04-PSSCRM + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: G2.2 + - entry-id: D1.1 + - id: M-OSPS-VM-05-PSSCRM + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: G5.4 + - entry-id: P4.1 + - entry-id: P4.2 + - entry-id: P4.3 + - entry-id: P4.4 + - entry-id: P4.5 + - id: M-OSPS-VM-06-PSSCRM + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: G5.4 + - entry-id: P4.1 + - entry-id: P4.2 + - entry-id: P4.3 + - entry-id: P4.4 + - entry-id: P4.5 diff --git a/baseline/mappings/osps-to-samm.yaml b/baseline/mappings/osps-to-samm.yaml new file mode 100644 index 00000000..248dd9e3 --- /dev/null +++ b/baseline/mappings/osps-to-samm.yaml @@ -0,0 +1,159 @@ +title: OSPS Baseline to OWASP SAMM Mapping +metadata: + id: osps-baseline-to-samm + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to OWASP SAMM. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: SAMM + title: OWASP Software Assurance Maturity Model + version: "2.0" + url: https://owaspsamm.org/model/ + description: The mission of OWASP Software Assurance Maturity Model (SAMM) is to be the prime maturity model for software assurance that provides an effective and measurable way for all types of organizations + to analyze and improve their software security posture. OWASP SAMM supports the complete software lifecycle, including development and acquisition, and is technology and process agnostic. It is + intentionally built to be evolutive and risk-driven in nature. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: SAMM + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-SAMM + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: Operations - Environment Management - Configuration Hardening Lvl1 + - id: M-OSPS-AC-04-SAMM + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: Operations - Environment Management - Configuration Hardening Lvl1 + - id: M-OSPS-BR-05-SAMM + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: Implementation - Secure Build - Build Process Lvl2 + - id: M-OSPS-BR-06-SAMM + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: Implementation - Secure Deployment - Deployment Process Lvl3 + - id: M-OSPS-DO-02-SAMM + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: Implementation - Defect Management - Defect Tracking Lvl1 + - entry-id: Implementation - Defect Management - Defect Tracking Lvl2 + - id: M-OSPS-DO-04-SAMM + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: Operations - Operational Management - System Decommissioning - Legacy Management Lvl1 + - id: M-OSPS-DO-05-SAMM + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: Operations - Operational Management - System Decommissioning - Legacy Management Lvl1 + - entry-id: Operations - Operational Management - System Decommissioning - Legacy Management Lvl2 + - id: M-OSPS-DO-06-SAMM + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: Design - Security Requirements - Supplier Security Lvl2 + - id: M-OSPS-QA-01-SAMM + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: Implementation - Secure Build - Build Process Lvl1 + - id: M-OSPS-QA-02-SAMM + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: Implementation - Secure Build - Software Dependencies Lvl1 + - id: M-OSPS-QA-03-SAMM + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: Implementation - Secure Build - Build Process Lvl3 + - entry-id: Implementation - Secure Build - Software Dependencies Lvl3 + - entry-id: Verification - Requirements-driven Testing - Control Verification Lvl1 + - entry-id: Verification - Requirements-driven Testing - Control Verification Lvl2 + - entry-id: Verification - Requirements-driven Testing - Control Verification Lvl3 + - id: M-OSPS-QA-06-SAMM + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: Verification - Requirements-driven Testing - Control Verification Lvl1 + - entry-id: Verification - Requirements-driven Testing - Control Verification Lvl2 + - entry-id: Verification - Requirements-driven Testing - Control Verification Lvl3 + - entry-id: Verification - Security Testing - Scalable Baseline Lvl3 + - id: M-OSPS-SA-01-SAMM + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: Operations - Operational Management - Data Protection Lvl2 + - id: M-OSPS-SA-03-SAMM + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: Governance - Strategy & Metrics - Create and Promote Lvl1 + - entry-id: Design - Threat Assessment - Application Risk Profile Lvl1 + - entry-id: Design - Threat Assessment - Threat Modeling Lvl1 + - entry-id: Verification - Architecture Assessment - Architecture Mitigation Lvl2 + - id: M-OSPS-VM-01-SAMM + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: Governance - Strategy & Metrics - Create and Promote Lvl2 + - entry-id: Governance - Policy & Compliance - Policy & Standards Lvl1 + - entry-id: Implementation - Defect Management - Defect Tracking Lvl1 + - entry-id: Implementation - Defect Management - Defect Tracking Lvl2 + - entry-id: Implementation - Defect Management - Defect Tracking Lvl3 + - entry-id: Operations - Incident Management - Incident Response Lvl1 + - entry-id: Operations - Incident Management - Incident Response Lvl2 + - entry-id: Operations - Incident Management - Incident Response Lvl3 + - id: M-OSPS-VM-02-SAMM + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: Governance - Policy & Compliance - Policy & Standards Lvl2 + - id: M-OSPS-VM-03-SAMM + source: OSPS-VM-03 + relationship: relates-to + targets: + - entry-id: Operations - Incident Management - Incident Response Lvl3 + - id: M-OSPS-VM-05-SAMM + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: Implementation - Secure Build - Build Process Lvl3 + - entry-id: Implementation - Secure Build - Software Dependencies Lvl3 + - entry-id: Verification - Security Testing - Scalable Baseline Lvl1 + - entry-id: Verification - Security Testing - Scalable Baseline Lvl3 + - id: M-OSPS-VM-06-SAMM + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: Implementation - Secure Build - Build Process Lvl3 + - entry-id: Implementation - Secure Build - Software Dependencies Lvl3 + - entry-id: Verification - Security Testing - Scalable Baseline Lvl1 + - entry-id: Verification - Security Testing - Scalable Baseline Lvl3 diff --git a/baseline/mappings/osps-to-scorecard.yaml b/baseline/mappings/osps-to-scorecard.yaml new file mode 100644 index 00000000..e7389893 --- /dev/null +++ b/baseline/mappings/osps-to-scorecard.yaml @@ -0,0 +1,106 @@ +title: OSPS Baseline to OpenSSF Scorecard Mapping +metadata: + id: osps-baseline-to-scorecard + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to OpenSSF Scorecard. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: Scorecard + title: OpenSSF Scorecard + version: "5.0" + url: https://github.com/ossf/scorecard + description: OpenSSF Scorecard is an automated tool that assesses a number of important heuristics ('checks') associated with software security and assigns each check a score of 0-10. You can use + these scores to understand specific areas to improve in order to strengthen the security posture of your project. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: Scorecard + entry-type: Guideline +mappings: + - id: M-OSPS-AC-03-Scorecard + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: Branch-Protection + - id: M-OSPS-BR-01-Scorecard + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: Dangerous-Workflow + - id: M-OSPS-BR-06-Scorecard + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: Signed-Releases + - id: M-OSPS-DO-06-Scorecard + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: Pinned-Dependencies + - id: M-OSPS-LE-02-Scorecard + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: License + - id: M-OSPS-LE-03-Scorecard + source: OSPS-LE-03 + relationship: relates-to + targets: + - entry-id: License + - id: M-OSPS-QA-05-Scorecard + source: OSPS-QA-05 + relationship: relates-to + targets: + - entry-id: Binary-Artifacts + - id: M-OSPS-QA-06-Scorecard + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: CI-Tests + - id: M-OSPS-QA-07-Scorecard + source: OSPS-QA-07 + relationship: relates-to + targets: + - entry-id: Code-Review + - id: M-OSPS-VM-01-Scorecard + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: Security-Policy + - id: M-OSPS-VM-02-Scorecard + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: Security-Policy + - id: M-OSPS-VM-05-Scorecard + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: Security-Policy + - entry-id: Vulnerabilities + - id: M-OSPS-VM-06-Scorecard + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: Security-Policy + - entry-id: Vulnerabilities + - entry-id: SAST diff --git a/baseline/mappings/osps-to-slsa.yaml b/baseline/mappings/osps-to-slsa.yaml new file mode 100644 index 00000000..0be67756 --- /dev/null +++ b/baseline/mappings/osps-to-slsa.yaml @@ -0,0 +1,88 @@ +title: OSPS Baseline to SLSA Mapping +metadata: + id: osps-baseline-to-slsa + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to SLSA. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: SLSA + title: Supply Chain Levels for Software Artifacts + version: "1.0" + url: https://github.com/slsa-framework/slsa + description: SLSA (pronounced "salsa") is a security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain + integrity. It’s how you get from safe enough to being as resilient as possible, at any link in the chain. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: SLSA + entry-type: Guideline +mappings: + - id: M-OSPS-AC-04-SLSA + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: Choose an appropriate build platform + - entry-id: Build platform - Isolation strength - Isolated + - id: M-OSPS-BR-01-SLSA + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: Choose an appropriate build platform + - id: M-OSPS-BR-02-SLSA + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: Follow a consistent build process + - entry-id: Build platform - Provenance generation - Exists + - entry-id: Build platform - Provenance generation - Authentic + - id: M-OSPS-BR-03-SLSA + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: Choose an appropriate build platform + - id: M-OSPS-BR-04-SLSA + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: Choose an appropriate build platform + - entry-id: Follow a consistent build process + - entry-id: Build platform - Isolation strength - Isolated + - id: M-OSPS-BR-05-SLSA + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: Build platform - Isolation strength - Isolated + - id: M-OSPS-BR-06-SLSA + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: Distribute provenance + - id: M-OSPS-QA-01-SLSA + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: Build platform - Isolation strength - Isolated + - id: M-OSPS-QA-04-SLSA + source: OSPS-QA-04 + relationship: relates-to + targets: + - entry-id: Build platform - Isolation strength - Isolated diff --git a/baseline/mappings/osps-to-ssdf.yaml b/baseline/mappings/osps-to-ssdf.yaml new file mode 100644 index 00000000..822f2829 --- /dev/null +++ b/baseline/mappings/osps-to-ssdf.yaml @@ -0,0 +1,296 @@ +title: OSPS Baseline to NIST SSDF Mapping +metadata: + id: osps-baseline-to-ssdf + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to NIST SSDF. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: SSDF + title: Secure Software Development Framework + version: "1.1" + url: https://csrc.nist.gov/pubs/sp/800/218/final + description: The Secure Software Development Framework (SSDF) is a set of fundamental, sound, and secure software development practices based on established secure software development practice documents + from organizations such as BSA, OWASP, and SAFECode. Few software development life cycle (SDLC) models explicitly address software security in detail, so practices like those in the SSDF need to + be added to and integrated with each SDLC implementation. Following the SSDF practices should help software producers reduce the number of vulnerabilities in released software, reduce the potential + impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent recurrences. Also, because the SSDF provides a common language + for describing secure software development practices, software producers and acquirers can use it to foster their communications for procurement processes and other management activities. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: SSDF + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-SSDF + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - entry-id: PS.1 + - entry-id: PS.2 + - id: M-OSPS-AC-02-SSDF + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: PO.2 + - entry-id: PO.3.2 + - entry-id: PS.1 + - entry-id: PS.2 + - id: M-OSPS-AC-03-SSDF + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - entry-id: PS.1 + - entry-id: PS.2 + - id: M-OSPS-AC-04-SSDF + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: PO.2 + - entry-id: PO.3.2 + - entry-id: PS.1 + - entry-id: PS.2 + - id: M-OSPS-BR-01-SSDF + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - entry-id: PO.5.2 + - entry-id: PS.1 + - entry-id: PS.2 + - id: M-OSPS-BR-02-SSDF + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - entry-id: PS.1 + - entry-id: PS.2 + - entry-id: PS.3 + - id: M-OSPS-BR-03-SSDF + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - entry-id: PO.5.2 + - entry-id: PS.1 + - entry-id: PS.2 + - id: M-OSPS-BR-04-SSDF + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: PS.1 + - entry-id: PS.2 + - entry-id: PS.3 + - entry-id: PW.1.2 + - id: M-OSPS-BR-05-SSDF + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - entry-id: PS.1 + - entry-id: PS.2 + - id: M-OSPS-BR-06-SSDF + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: PO.5.2 + - entry-id: PS.2 + - entry-id: PS.2.1 + - entry-id: PW.6.2 + - id: M-OSPS-BR-07-SSDF + source: OSPS-BR-07 + relationship: relates-to + targets: + - entry-id: PO.1.1 + - entry-id: PO.3.1 + - entry-id: PO.4.2 + - entry-id: PO.5.1 + - entry-id: PW.1.2 + - entry-id: PW.1.3 + - entry-id: PW.5.1 + - id: M-OSPS-DO-01-SSDF + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: PW.1.2 + - id: M-OSPS-DO-02-SSDF + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: PW.1.2 + - entry-id: RV.1.1 + - entry-id: RV.2.1 + - entry-id: RV.1.2 + - id: M-OSPS-DO-03-SSDF + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: PO.4.2 + - entry-id: PS.2 + - entry-id: PS.2.1 + - entry-id: PS.3.1 + - entry-id: RV.1.3 + - id: M-OSPS-DO-04-SSDF + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: PO.4.2 + - entry-id: PS.3.1 + - entry-id: RV.1.3 + - id: M-OSPS-GV-02-SSDF + source: OSPS-GV-02 + relationship: relates-to + targets: + - entry-id: PS.3 + - entry-id: PW.1.2 + - id: M-OSPS-GV-03-SSDF + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: PW.1.2 + - id: M-OSPS-GV-04-SSDF + source: OSPS-GV-04 + relationship: relates-to + targets: + - entry-id: PO.2 + - entry-id: PO.3.2 + - id: M-OSPS-LE-01-SSDF + source: OSPS-LE-01 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - entry-id: PS.1 + - entry-id: PW.1.2 + - entry-id: PW.2.1 + - id: M-OSPS-LE-02-SSDF + source: OSPS-LE-02 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - id: M-OSPS-LE-03-SSDF + source: OSPS-LE-03 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - id: M-OSPS-QA-01-SSDF + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: PS.1 + - entry-id: PS.2 + - entry-id: PS.3 + - entry-id: PW.1.2 + - entry-id: PW.2.1 + - id: M-OSPS-QA-02-SSDF + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: PO.3.3 + - entry-id: PS.1 + - entry-id: PS.2 + - entry-id: PS.3.2 + - entry-id: PW.4 + - id: M-OSPS-QA-03-SSDF + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: PO.4.1 + - entry-id: PS.1 + - entry-id: PS.2 + - entry-id: RV.1.2 + - id: M-OSPS-QA-04-SSDF + source: OSPS-QA-04 + relationship: relates-to + targets: + - entry-id: PO.3.2 + - entry-id: PO.4.1 + - entry-id: PS.1 + - entry-id: PS.2 + - entry-id: RV.1.2 + - id: M-OSPS-QA-05-SSDF + source: OSPS-QA-05 + relationship: relates-to + targets: + - entry-id: PS.1 + - entry-id: PS.2 + - id: M-OSPS-QA-06-SSDF + source: OSPS-QA-06 + relationship: relates-to + targets: + - entry-id: PW.8.2 + - id: M-OSPS-SA-01-SSDF + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: PO.1 + - entry-id: PO.2 + - entry-id: PO.3.2 + - id: M-OSPS-SA-02-SSDF + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: PW.1.2 + - id: M-OSPS-SA-03-SSDF + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: PO.5.1 + - entry-id: PW.1.1 + - id: M-OSPS-VM-01-SSDF + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: RV.1.3 + - id: M-OSPS-VM-02-SSDF + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: RV.1.3 + - id: M-OSPS-VM-04-SSDF + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: PO.4.1 + - entry-id: RV.2.1 + - entry-id: RV.2.2 + - id: M-OSPS-VM-05-SSDF + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: PO.4 + - entry-id: PW.1.2 + - entry-id: PW.8.1 + - entry-id: RV.1.2 + - entry-id: RV.1.3 + - entry-id: RV.2.1 + - entry-id: RV.2.2 + - id: M-OSPS-VM-06-SSDF + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: PO.4 + - entry-id: PW.1.2 + - entry-id: PW.8.1 + - entry-id: RV.1.2 + - entry-id: RV.1.3 + - entry-id: RV.2.1 + - entry-id: RV.2.2 diff --git a/baseline/mappings/osps-to-uksscop.yaml b/baseline/mappings/osps-to-uksscop.yaml new file mode 100644 index 00000000..c3239fa5 --- /dev/null +++ b/baseline/mappings/osps-to-uksscop.yaml @@ -0,0 +1,228 @@ +title: OSPS Baseline to UK NCSC Software Security Code of Practice Mapping +metadata: + id: osps-baseline-to-uksscop + type: MappingDocument + gemara-version: "1.2.0" + description: | + Cross-walk from the Open Source Project Security (OSPS) Baseline + controls to UK NCSC Software Security Code of Practice. Each mapping asserts a "relates-to" + relationship; strength, confidence-level, and rationale are left + unset and should be added as the mappings are individually + reviewed. + draft: true + author: + id: openssf + name: OSPS Baseline Authors + type: Human + mapping-references: + - id: osps-baseline + title: Open Source Project Security Baseline + version: "draft" + url: https://github.com/ossf/security-baseline + description: | + The Open Source Project Security (OSPS) Baseline is a set of security + criteria that projects should meet to demonstrate a strong security + posture. + - id: UKSSCOP + title: United Kingdom National Cyber Security Centre Software Security Code of Practice + version: "2025-05-07" + url: https://www.ncsc.gov.uk/guidance/software-security-code-of-practice-assurance-principles-claims + description: The Software Code of Practice has been created by DSIT and the National Cyber Security Centre (NCSC), the UK’s technical authority for cyber security, and is co-sealed by the Canadian + Centre for Cyber Security (CCCS). The Code reflects the government’s ongoing focus on codifying minimum standards for technology providers to reduce cyber risk. It is aimed at professionals who + are responsible for overseeing the development of ‘commodity’ software, including technical, compliance, and risk experts. For those organisations that require a higher level of assurance in the + resilience of their connected products and technology, consider using the NCSC’s Cyber Resilience Testing scheme. +source-reference: + reference-id: osps-baseline + entry-type: Control +target-reference: + reference-id: UKSSCOP + entry-type: Guideline +mappings: + - id: M-OSPS-AC-01-UKSSCOP + source: OSPS-AC-01 + relationship: relates-to + targets: + - entry-id: Claim 1.4.2 + - entry-id: Claim 2.1.5 + - entry-id: Claim 2.2.2 + - id: M-OSPS-AC-02-UKSSCOP + source: OSPS-AC-02 + relationship: relates-to + targets: + - entry-id: Claim 2.2.2 + - id: M-OSPS-AC-03-UKSSCOP + source: OSPS-AC-03 + relationship: relates-to + targets: + - entry-id: Claim 1.1.4 + - entry-id: Claim 2.2.2 + - id: M-OSPS-AC-04-UKSSCOP + source: OSPS-AC-04 + relationship: relates-to + targets: + - entry-id: Claim 2.1.1 + - entry-id: Claim 2.1.3 + - entry-id: Claim 2.2.2 + - id: M-OSPS-BR-01-UKSSCOP + source: OSPS-BR-01 + relationship: relates-to + targets: + - entry-id: Claim 2.1.2 + - entry-id: Claim 2.2.2 + - id: M-OSPS-BR-02-UKSSCOP + source: OSPS-BR-02 + relationship: relates-to + targets: + - entry-id: Claim 1.1.4 + - entry-id: Claim 3.1.1 + - entry-id: Claim 3.4.2 + - id: M-OSPS-BR-03-UKSSCOP + source: OSPS-BR-03 + relationship: relates-to + targets: + - entry-id: Claim 3.1.2 + - id: M-OSPS-BR-04-UKSSCOP + source: OSPS-BR-04 + relationship: relates-to + targets: + - entry-id: Claim 1.1.4 + - entry-id: Claim 2.2.3 + - entry-id: Claim 3.1.1 + - id: M-OSPS-BR-05-UKSSCOP + source: OSPS-BR-05 + relationship: relates-to + targets: + - entry-id: Claim 1.2.1 + - entry-id: Claim 1.2.5 + - id: M-OSPS-BR-06-UKSSCOP + source: OSPS-BR-06 + relationship: relates-to + targets: + - entry-id: Claim 1.2.2 + - entry-id: Claim 3.1.1 + - id: M-OSPS-BR-07-UKSSCOP + source: OSPS-BR-07 + relationship: relates-to + targets: + - entry-id: Claim 1.4.3 + - entry-id: Claim 1.4.5 + - id: M-OSPS-DO-01-UKSSCOP + source: OSPS-DO-01 + relationship: relates-to + targets: + - entry-id: '4.1' + - id: M-OSPS-DO-02-UKSSCOP + source: OSPS-DO-02 + relationship: relates-to + targets: + - entry-id: '1.1' + - entry-id: '1.3' + - id: M-OSPS-DO-03-UKSSCOP + source: OSPS-DO-03 + relationship: relates-to + targets: + - entry-id: '3.1' + - id: M-OSPS-DO-04-UKSSCOP + source: OSPS-DO-04 + relationship: relates-to + targets: + - entry-id: '4.1' + - entry-id: '4.2' + - entry-id: Claim 4.1.1 + - entry-id: Claim 4.1.2 + - entry-id: Claim 4.2.1 + - id: M-OSPS-DO-05-UKSSCOP + source: OSPS-DO-05 + relationship: relates-to + targets: + - entry-id: '3.5' + - entry-id: '4.1' + - entry-id: Claim 4.1.1 + - entry-id: Claim 4.2.1 + - id: M-OSPS-DO-06-UKSSCOP + source: OSPS-DO-06 + relationship: relates-to + targets: + - entry-id: '1.2' + - entry-id: '3.3' + - entry-id: Claim 1.2.1 + - entry-id: Claim 1.2.2 + - id: M-OSPS-GV-01-UKSSCOP + source: OSPS-GV-01 + relationship: relates-to + targets: + - entry-id: Claim 2.1.1 + - id: M-OSPS-GV-03-UKSSCOP + source: OSPS-GV-03 + relationship: relates-to + targets: + - entry-id: Claim 2.1.1 + - id: M-OSPS-QA-01-UKSSCOP + source: OSPS-QA-01 + relationship: relates-to + targets: + - entry-id: Claim 2.2.3 + - id: M-OSPS-QA-02-UKSSCOP + source: OSPS-QA-02 + relationship: relates-to + targets: + - entry-id: Claim 1.2.1 + - entry-id: Claim 1.2.2 + - entry-id: Claim 3.1.1 + - id: M-OSPS-QA-03-UKSSCOP + source: OSPS-QA-03 + relationship: relates-to + targets: + - entry-id: Claim 1.3.2 + - entry-id: Claim 1.3.3 + - id: M-OSPS-SA-01-UKSSCOP + source: OSPS-SA-01 + relationship: relates-to + targets: + - entry-id: Claim 1.1.5 + - id: M-OSPS-SA-02-UKSSCOP + source: OSPS-SA-02 + relationship: relates-to + targets: + - entry-id: Claim 1.1.5 + - id: M-OSPS-SA-03-UKSSCOP + source: OSPS-SA-03 + relationship: relates-to + targets: + - entry-id: Claim 1.4.1 + - id: M-OSPS-VM-01-UKSSCOP + source: OSPS-VM-01 + relationship: relates-to + targets: + - entry-id: Claim 3.4.1 + - entry-id: Claim 3.5.1 + - entry-id: Claim 4.1.2 + - id: M-OSPS-VM-02-UKSSCOP + source: OSPS-VM-02 + relationship: relates-to + targets: + - entry-id: '3.2' + - id: M-OSPS-VM-03-UKSSCOP + source: OSPS-VM-03 + relationship: relates-to + targets: + - entry-id: '3.2' + - id: M-OSPS-VM-04-UKSSCOP + source: OSPS-VM-04 + relationship: relates-to + targets: + - entry-id: '3.4' + - entry-id: '3.5' + - entry-id: '4.3' + - id: M-OSPS-VM-05-UKSSCOP + source: OSPS-VM-05 + relationship: relates-to + targets: + - entry-id: '1.2' + - entry-id: '3.3' + - id: M-OSPS-VM-06-UKSSCOP + source: OSPS-VM-06 + relationship: relates-to + targets: + - entry-id: '1.3' + - entry-id: '1.4' diff --git a/baseline/metadata.yaml b/baseline/metadata.yaml index 9801753b..ddabd1a3 100644 --- a/baseline/metadata.yaml +++ b/baseline/metadata.yaml @@ -2,12 +2,12 @@ title: Open Source Project Security Baseline metadata: id: osps-baseline type: ControlCatalog - gemara-version: v1.0.0-rc.2 + gemara-version: "1.2.0" description: | The Open Source Project Security (OSPS) Baseline is a set of security criteria that projects should meet to demonstrate a strong security posture. draft: true author: - id: baseline-authors + id: openssf name: OSPS Baseline Authors type: Human applicability-groups: @@ -26,6 +26,11 @@ metadata: version: 2024 url: https://github.com/coreinfrastructure/best-practices-badge/blob/main/criteria/criteria.yml description: "The Open Source Security Foundation (OpenSSF) Best Practices Badge is a way for Free/Libre and Open Source Software (FLOSS) projects to show that they follow best practices. Projects can voluntarily self-certify, at no cost, by using this web application to explain how they follow each best practice. The OpenSSF Best Practices Badge is inspired by the many badges available to projects on GitHub. Consumers of the badge can quickly assess which FLOSS projects are following best practices and, as a result, are more likely to produce higher-quality secure software." + - id: Scorecard + title: OpenSSF Scorecard + version: "5.0" + url: https://github.com/ossf/scorecard + description: "OpenSSF Scorecard is an automated tool that assesses a number of important heuristics ('checks') associated with software security and assigns each check a score of 0-10. You can use these scores to understand specific areas to improve in order to strengthen the security posture of your project." - id: CSF title: NIST Cybersecurity Framework version: 2.0 @@ -41,12 +46,12 @@ metadata: version: 1.1 url: https://csrc.nist.gov/pubs/sp/800/218/final description: "The Secure Software Development Framework (SSDF) is a set of fundamental, sound, and secure software development practices based on established secure software development practice documents from organizations such as BSA, OWASP, and SAFECode. Few software development life cycle (SDLC) models explicitly address software security in detail, so practices like those in the SSDF need to be added to and integrated with each SDLC implementation. Following the SSDF practices should help software producers reduce the number of vulnerabilities in released software, reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent recurrences. Also, because the SSDF provides a common language for describing secure software development practices, software producers and acquirers can use it to foster their communications for procurement processes and other management activities." - - id: OC + - id: ISO-18974 title: ISO/IEC 18974 version: 1.0 - 2023-12 url: https://openchainproject.org/security-assurance description: "ISO/IEC 18974 helps organizations check open source for known security vulnerability issues like CVEs, GitHub dependency alerts or package manager alerts. ISO/IEC 18974 identifies: The key places to have security processes, How to assign roles and responsibilities, And how to ensure sustainability of the processes. ISO/IEC 18974 is lightweight, easy to read and is supported by our global community with free reference material and conformance resources." - - id: OCRE + - id: OpenCRE title: Open Cybersecurity Reference Architecture version: 2024 url: https://github.com/OWASP/OpenCRE diff --git a/cmd/pkg/baseline/generator.go b/cmd/pkg/baseline/generator.go index 3af13e7b..0bc961d2 100644 --- a/cmd/pkg/baseline/generator.go +++ b/cmd/pkg/baseline/generator.go @@ -51,6 +51,9 @@ func (g *Generator) ExportMarkdown(b *types.Baseline, templatePath, path string) "applicabilityTitle": func(id string) string { return applicabilityTitle(b.Catalog.Metadata.ApplicabilityGroups, id) }, + "relationsForControl": func(controlID string) []FrameworkRelation { + return relationsForControl(b.Mappings, controlID) + }, }).Parse(string(templateContent)) if err != nil { return fmt.Errorf("error parsing template: %w", err) diff --git a/cmd/pkg/baseline/generator_crosswalk.go b/cmd/pkg/baseline/generator_crosswalk.go index a0f05fbe..73ae3d1f 100644 --- a/cmd/pkg/baseline/generator_crosswalk.go +++ b/cmd/pkg/baseline/generator_crosswalk.go @@ -16,20 +16,24 @@ import ( // Framework name -> Requirement ID -> sorted list of OSPS Control IDs type reverseCrosswalkMap map[string]map[string][]string -// buildReverseCrosswalk iterates through the Gemara catalog and +// buildReverseCrosswalk iterates the loaded #MappingDocument artifacts and // inverts the Baseline -> External mapping into External -> Baseline. +// The framework name is taken from each mapping document's TargetReference. func buildReverseCrosswalk(b *types.Baseline) reverseCrosswalkMap { result := make(reverseCrosswalkMap) - for i := range b.Catalog.Controls { - control := &b.Catalog.Controls[i] - controlID := control.Id // FIXED: 'Id' instead of 'ID' - // A guideline is a MultiEntryMapping - for _, guideline := range control.Guidelines { - // The Framework name is usually stored in ReferenceId - framework := guideline.ReferenceId - // We have to loop through the specific requirements under this framework - for _, entry := range guideline.Entries { - reqID := entry.ReferenceId // e.g. "CC6.1", "AC-2" + for i := range b.Mappings { + doc := &b.Mappings[i] + framework := doc.TargetReference.ReferenceId + if framework == "" { + continue + } + for _, m := range doc.Mappings { + controlID := m.Source + for _, t := range m.Targets { + reqID := t.EntryId + if reqID == "" { + continue + } if _, ok := result[framework]; !ok { result[framework] = make(map[string][]string) } diff --git a/cmd/pkg/baseline/generator_crosswalk_test.go b/cmd/pkg/baseline/generator_crosswalk_test.go index 1348eed8..a30151ba 100644 --- a/cmd/pkg/baseline/generator_crosswalk_test.go +++ b/cmd/pkg/baseline/generator_crosswalk_test.go @@ -16,32 +16,44 @@ func setupFakeBaseline() *types.Baseline { return &types.Baseline{ Catalog: gemara.ControlCatalog{ Controls: []gemara.Control{ - { - Id: "OSPS-AC-01", - Guidelines: []gemara.MultiEntryMapping{ - { - ReferenceId: "NIST SP 800-53", - Entries: []gemara.ArtifactMapping{ - {ReferenceId: "AC-2"}, - {ReferenceId: "AC-3"}, - }, + {Id: "OSPS-AC-01"}, + {Id: "OSPS-GV-01"}, + }, + }, + Mappings: []gemara.MappingDocument{ + { + SourceReference: gemara.TypedMapping{ReferenceId: "osps-baseline", EntryType: gemara.EntryTypeControl}, + TargetReference: gemara.TypedMapping{ReferenceId: "NIST SP 800-53", EntryType: gemara.EntryTypeGuideline}, + Mappings: []gemara.Mapping{ + { + Id: "M-OSPS-AC-01-NIST", + Source: "OSPS-AC-01", + Relationship: gemara.RelRelatesTo, + Targets: []gemara.MappingTarget{ + {EntryId: "AC-2"}, + {EntryId: "AC-3"}, }, }, - }, - { - Id: "OSPS-GV-01", - Guidelines: []gemara.MultiEntryMapping{ - { - ReferenceId: "NIST SP 800-53", - Entries: []gemara.ArtifactMapping{ - {ReferenceId: "AC-2"}, - }, + { + Id: "M-OSPS-GV-01-NIST", + Source: "OSPS-GV-01", + Relationship: gemara.RelRelatesTo, + Targets: []gemara.MappingTarget{ + {EntryId: "AC-2"}, }, - { - ReferenceId: "CIS Controls v8", - Entries: []gemara.ArtifactMapping{ - {ReferenceId: "1.1"}, - }, + }, + }, + }, + { + SourceReference: gemara.TypedMapping{ReferenceId: "osps-baseline", EntryType: gemara.EntryTypeControl}, + TargetReference: gemara.TypedMapping{ReferenceId: "CIS Controls v8", EntryType: gemara.EntryTypeGuideline}, + Mappings: []gemara.Mapping{ + { + Id: "M-OSPS-GV-01-CIS", + Source: "OSPS-GV-01", + Relationship: gemara.RelRelatesTo, + Targets: []gemara.MappingTarget{ + {EntryId: "1.1"}, }, }, }, diff --git a/cmd/pkg/baseline/loader.go b/cmd/pkg/baseline/loader.go index a289a43c..4cadc102 100644 --- a/cmd/pkg/baseline/loader.go +++ b/cmd/pkg/baseline/loader.go @@ -8,6 +8,7 @@ import ( "fmt" "os" "path/filepath" + "sort" "strings" "github.com/gemaraproj/go-gemara" @@ -20,6 +21,7 @@ import ( const ( LexiconFilename = "lexicon.yaml" MetadataFilename = "metadata.yaml" + MappingsDirname = "mappings" ) // Loader reads baseline data from a directory of YAML source files @@ -52,6 +54,13 @@ func (l *Loader) Load() (*types.Baseline, error) { } b.Catalog = *catalog + + mappings, err := l.loadMappings() + if err != nil { + return nil, fmt.Errorf("error reading mappings: %w", err) + } + b.Mappings = mappings + return b, nil } @@ -110,6 +119,43 @@ func toFileURI(path string) string { return cleaned } +// loadMappings decodes every #MappingDocument YAML file found under the +// baseline's mappings/ subdirectory. Results are returned sorted by file name +// to keep downstream output deterministic. +func (l *Loader) loadMappings() ([]gemara.MappingDocument, error) { + mappingsDir := filepath.Join(l.DataPath, MappingsDirname) + entries, err := os.ReadDir(mappingsDir) + if err != nil { + if os.IsNotExist(err) { + return nil, nil + } + return nil, fmt.Errorf("reading mappings directory: %w", err) + } + + files := make([]string, 0, len(entries)) + for _, e := range entries { + if e.IsDir() { + continue + } + name := e.Name() + if filepath.Ext(name) != ".yaml" && filepath.Ext(name) != ".yml" { + continue + } + files = append(files, name) + } + sort.Strings(files) + + docs := make([]gemara.MappingDocument, 0, len(files)) + for _, name := range files { + var doc gemara.MappingDocument + if err := decodeYAMLFile(filepath.Join(mappingsDir, name), &doc); err != nil { + return nil, fmt.Errorf("decoding mapping %s: %w", name, err) + } + docs = append(docs, doc) + } + return docs, nil +} + // loadControlFamilies decodes per-family YAML files and appends their groups // and controls onto the provided catalog. func (l *Loader) loadControlFamilies(catalog *gemara.ControlCatalog) error { diff --git a/cmd/pkg/baseline/template-functions.go b/cmd/pkg/baseline/template-functions.go index d53b6e17..4db887ac 100644 --- a/cmd/pkg/baseline/template-functions.go +++ b/cmd/pkg/baseline/template-functions.go @@ -129,6 +129,50 @@ func controlsForGroup(controls []gemara.Control, groupID string) []gemara.Contro return out } +// FrameworkRelation describes how a control relates to a single external framework. +// It mirrors the shape the markdown template needs to render the per-control +// "External Framework Relations" section. +type FrameworkRelation struct { + Framework string + Entries []string +} + +// relationsForControl returns the external framework relations for a given OSPS +// control id, aggregated from the loaded #MappingDocument artifacts. The result +// is sorted by framework name for deterministic output. +func relationsForControl(mappings []gemara.MappingDocument, controlID string) []FrameworkRelation { + byFW := map[string][]string{} + for i := range mappings { + doc := &mappings[i] + fw := doc.TargetReference.ReferenceId + if fw == "" { + continue + } + for _, m := range doc.Mappings { + if m.Source != controlID { + continue + } + for _, t := range m.Targets { + if t.EntryId == "" { + continue + } + byFW[fw] = append(byFW[fw], t.EntryId) + } + } + } + if len(byFW) == 0 { + return nil + } + out := make([]FrameworkRelation, 0, len(byFW)) + for fw, entries := range byFW { + out = append(out, FrameworkRelation{Framework: fw, Entries: entries}) + } + slices.SortFunc(out, func(a, b FrameworkRelation) int { + return strings.Compare(a.Framework, b.Framework) + }) + return out +} + // loop through maturityLevels // to see if any are higher than the targetMaturity func maxLevel(maturityLevels []string, targetMaturity int) bool { diff --git a/cmd/pkg/types/types.go b/cmd/pkg/types/types.go index 2ef3b8d9..1cf8bd0c 100644 --- a/cmd/pkg/types/types.go +++ b/cmd/pkg/types/types.go @@ -18,8 +18,9 @@ var ControlFamilies = []string{ // Struct for holding the entire YAML structure type Baseline struct { - Catalog gemara.ControlCatalog - Lexicon []LexiconEntry + Catalog gemara.ControlCatalog + Lexicon []LexiconEntry + Mappings []gemara.MappingDocument } type LexiconEntry struct { diff --git a/cmd/template.md b/cmd/template.md index 4f3722ed..26504244 100644 --- a/cmd/template.md +++ b/cmd/template.md @@ -114,9 +114,10 @@ For more information on the project and to make contributions, visit the [GitHub {{ end }} #### External Framework Relations -{{ if .Guidelines }} - {{ range .Guidelines }} - - **{{ .ReferenceId | addLinks }}**: {{ range $index, $entry := .Entries }}{{ if $index }}, {{ end }}{{ $entry.ReferenceId }}{{ end }} +{{- $relations := relationsForControl .Id }} +{{ if $relations }} + {{ range $relations }} + - **{{ .Framework | addLinks }}**: {{ range $index, $entry := .Entries }}{{ if $index }}, {{ end }}{{ $entry }}{{ end }} {{- end }} {{ end }} diff --git a/schema/cue.mod/module.cue b/schema/cue.mod/module.cue index c439aba4..92777685 100644 --- a/schema/cue.mod/module.cue +++ b/schema/cue.mod/module.cue @@ -4,6 +4,6 @@ language: { } deps: { "github.com/gemaraproj/gemara@v1": { - v: "v1.0.0-rc.2" + v: "v1.2.0" } } diff --git a/schema/osps.cue b/schema/osps.cue index f03da337..ddf8cecd 100644 --- a/schema/osps.cue +++ b/schema/osps.cue @@ -10,3 +10,10 @@ import "github.com/gemaraproj/gemara@v1" metadata: "applicability-groups": [{id: _agID}, ...{id: _agID}] } + +// #OSPSMapping layers OSPS-specific constraints on top of the Gemara #MappingDocument. +// Every OSPS mapping document maps FROM the osps-baseline catalog OUT to an +// external framework, so the source reference is pinned to "osps-baseline". +#OSPSMapping: gemara.#MappingDocument & { + "source-reference": "reference-id": "osps-baseline" +}