security-baseline

security-baseline copied to clipboard

Revisit Control Objectives to separate from assessment criteria

1

From the 2025-11-25 meeting: @eddie-knight would like control objectives to focus more on objectives and less on defining requirements. Example: > "Ensure that there is no MITM modification of assets...

evankanderson

Revise QA-04.01 to apply only to projects with subprojects, move to level 2

2

As discussed in the 2025-11-25 meeting. In my opinion, if projects with only a single repository don't need to do anything (e.g. no security-insights or SBOM) to indicate that status,...

evankanderson

Update BR-01 to split CI/CD security into 3 areas

3

As discussed in the 2025-11-25 meeting and on Slack. The BR-01 controls was originally lifted from the [Scorecard `Dangerous-Workflow` check](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow). When this control was refactored into assessment criteria, we ended...

evankanderson

Increase resolution of mapping applicability

2

as I stated in https://github.com/ossf/security-baseline/pull/427/files#r2565105191, when doing these mappings, I'd sort them into COMPLETE (coverage), PARTIAL (Coverage), SUPPORTS (as I feel the case is here), or N/A NONE (does not...

funnelfiasco

Add UKSSCOP reference-ids and claims to OSPS-BR.yaml

1

Added UKSSCOP reference IDs and claims to multiple sections. Dependent upon merge of #426 BR mappings to UKSSCOP framework

SecurityCRob

Add UKSSCOP reference-ids and claims to OSPS-QA.yaml

1

Added new reference IDs under UKSSCOP and updated existing ones. Dependent upon merge of #426 QA mappings to UKSSCOP framework

SecurityCRob

Update UKSSCOP reference-ids in OSPS-VM.yaml

1

Added UKSSCOP reference IDs and claims to multiple sections. Dependent upon merge of #426 VM mappings to UKSSCOP framework

SecurityCRob

Add UKSSCOP reference-ids and claims to OSPS-AC.yaml

1

Dependent upon merge of https://github.com/ossf/security-baseline/pull/426 AC mappings to UKSSCOP framework

SecurityCRob

As discussed in the 2025-11-25 meeting, correct the recommendation for OSPS-BR-03.02.

evankanderson

Help maintainers with answering questions as much as possible

4

The checklist contains various controls for which either - I don't know if it's the case (e.g. OSPS-AC-01.01 and OSPS-AC-02.01) where it would be helpful if you could tell me...

ericcornelissen