diff --git a/.gitignore b/.gitignore index 4ae20cae..723828fe 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,6 @@ docs/_site # generated output from go run ./... compile checklist.md + +# go build artifacts +cmd/security-baseline \ No newline at end of file diff --git a/baseline/OSPS-AC.yaml b/baseline/OSPS-AC.yaml index aa2856e1..de91931c 100644 --- a/baseline/OSPS-AC.yaml +++ b/baseline/OSPS-AC.yaml @@ -18,57 +18,59 @@ controls: repository settings or accessing sensitive data. guideline-mappings: - reference-id: BPB - identifiers: - - CC-G-1 + entries: + - reference-id: CC-G-1 - reference-id: CRA - identifiers: - - 1.2d - - 1.2e - - 1.2f + entries: + - reference-id: 1.2d + - reference-id: 1.2e + - reference-id: 1.2f - reference-id: SSDF - identifiers: - - PO.3.2 - - PS.1 - - PS.2 + entries: + - reference-id: PO.3.2 + - reference-id: PS.1 + - reference-id: PS.2 - reference-id: CSF - identifiers: - - PR.A-02 - - PR.A-05 + entries: + - reference-id: PR.A-02 + - reference-id: PR.A-05 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 - - 347-352 - - 333-858 - - 152-725 - - 201-246 + entries: + - reference-id: 486-813 + - reference-id: 124-564 + - reference-id: 347-352 + - reference-id: 333-858 + - reference-id: 152-725 + - reference-id: 201-246 - reference-id: PSSCRM - identifiers: - - G2.6 - - P3.3 - - E1.2 - - E1.3 - - E1.4 - - E3.1 + entries: + - reference-id: G2.6 + - reference-id: P3.3 + - reference-id: E1.2 + - reference-id: E1.3 + - reference-id: E1.4 + - reference-id: E3.1 - reference-id: SAMM - identifiers: - - Operations -Environment Management -Configuration Hardening Lvl1 + entries: + - reference-id: Operations -Environment Management -Configuration Hardening Lvl1 - reference-id: PCIDSS - identifiers: - - 2.2.1 - - 8.2.1 - - 8.3.1 + entries: + - reference-id: 2.2.1 + - reference-id: 8.2.1 + - reference-id: 8.3.1 - reference-id: UKSSCOP - identifiers: - - 2.1 + entries: + - reference-id: 2.1 - reference-id: 800-161 - identifiers: - - AC-4(21) - - AC-17 - - CM-5 - - CM-6 - - IA-2 - - IA-5 + entries: + - reference-id: AC-4(21) + - reference-id: AC-17 + - reference-id: CM-5 + - reference-id: CM-6 + - reference-id: IA-2 + - reference-id: IA-5 + - reference-id: 1.2e + - reference-id: 1.2f assessment-requirements: - id: OSPS-AC-01.01 text: | @@ -94,45 +96,45 @@ controls: limiting the permissions granted to new collaborators. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2f + entries: + - reference-id: 1.2f - reference-id: SSDF - identifiers: - - PO.2 - - PO.3.2 - - PS.1 - - PS.2 + entries: + - reference-id: PO.2 + - reference-id: PO.3.2 + - reference-id: PS.1 + - reference-id: PS.2 - reference-id: CSF - identifiers: - - PR.AA-02 - - PR.AA-05 + entries: + - reference-id: PR.AA-02 + - reference-id: PR.AA-05 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 - - 802-056 - - 368-633 - - 152-725 + entries: + - reference-id: 486-813 + - reference-id: 124-564 + - reference-id: 802-056 + - reference-id: 368-633 + - reference-id: 152-725 - reference-id: PSSCRM - identifiers: - - P2.3 - - E1.2 - - E3.3 + entries: + - reference-id: P2.3 + - reference-id: E1.2 + - reference-id: E3.3 - reference-id: PCIDSS - identifiers: - - 2.2.1 + entries: + - reference-id: 2.2.1 - reference-id: UKSSCOP - identifiers: - - 2.1 + entries: + - reference-id: 2.1 - reference-id: 800-161 - identifiers: - - AC-2 - - AC-3 - - AC-4(21) - - AC-5 - - AC-6 - - CM-5 - - CM-7 + entries: + - reference-id: AC-2 + - reference-id: AC-3 + - reference-id: AC-4(21) + - reference-id: AC-5 + - reference-id: AC-6 + - reference-id: CM-5 + - reference-id: CM-7 assessment-requirements: - id: OSPS-AC-02.01 text: | @@ -158,45 +160,45 @@ controls: of the project's repository by preventing unintentional modification. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2f + entries: + - reference-id: 1.2f - reference-id: SSDF - identifiers: - - PO.3.2 - - PS.1 - - PS.2 + entries: + - reference-id: PO.3.2 + - reference-id: PS.1 + - reference-id: PS.2 - reference-id: CSF - identifiers: - - PR.A-02 - - PR.A-05 + entries: + - reference-id: PR.A-02 + - reference-id: PR.A-05 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 - - 152-725 + entries: + - reference-id: 486-813 + - reference-id: 124-564 + - reference-id: 152-725 - reference-id: Scorecard - identifiers: - - Branch-Protection + entries: + - reference-id: Branch-Protection - reference-id: PSSCRM - identifiers: - - P3.2 - - P3.5 - - E1.5 - - E3.1 + entries: + - reference-id: P3.2 + - reference-id: P3.5 + - reference-id: E1.5 + - reference-id: E3.1 - reference-id: PCIDSS - identifiers: - - 2.2.1 + entries: + - reference-id: 2.2.1 - reference-id: UKSSCOP - identifiers: - - 2.1 - - 2.2 + entries: + - reference-id: 2.1 + - reference-id: 2.2 - reference-id: 800-161 - identifiers: - - AC-3 - - AC-5 - - CM-3 - - CM-3(2) - - CM-5 + entries: + - reference-id: AC-3 + - reference-id: AC-5 + - reference-id: CM-3 + - reference-id: CM-3(2) + - reference-id: CM-5 assessment-requirements: - id: OSPS-AC-03.01 text: | @@ -235,55 +237,55 @@ controls: pipelines. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2d - - 1.2e - - 1.2f + entries: + - reference-id: 1.2d + - reference-id: 1.2e + - reference-id: 1.2f - reference-id: SSDF - identifiers: - - PO.2 - - PO.3.2 - - PS.1 - - PS.2 + entries: + - reference-id: PO.2 + - reference-id: PO.3.2 + - reference-id: PS.1 + - reference-id: PS.2 - reference-id: CSF - identifiers: - - PR.AA-02 - - PR.AA-05 + entries: + - reference-id: PR.AA-02 + - reference-id: PR.AA-05 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 - - 347-507 - - 263-284 - - 123-124 + entries: + - reference-id: 486-813 + - reference-id: 124-564 + - reference-id: 347-507 + - reference-id: 263-284 + - reference-id: 123-124 - reference-id: SLSA - identifiers: - - Producer - Choose an appropriate build platform - - Build platform - Isolation strength - Isolated + entries: + - reference-id: Producer - Choose an appropriate build platform + - reference-id: Build platform - Isolation strength - Isolated - reference-id: PSSCRM - identifiers: - - P3.2 + entries: + - reference-id: P3.2 - reference-id: SAMM - identifiers: - - Operations -Environment Management -Configuration Hardening Lvl1 + entries: + - reference-id: Operations -Environment Management -Configuration Hardening Lvl1 - reference-id: PCIDSS - identifiers: - - 2.2.1 - - 8.2.1 + entries: + - reference-id: 2.2.1 + - reference-id: 8.2.1 - reference-id: UKSSCOP - identifiers: - - 2.1 - - 2.2 + entries: + - reference-id: 2.1 + - reference-id: 2.2 - reference-id: 800-161 - identifiers: - - AC-3(8) - - AC-4 - - AC-4(6) - - AC-6 - - AC-20 - - AC-20(1) - - CM-5 - - CM-7 + entries: + - reference-id: AC-3(8) + - reference-id: AC-4 + - reference-id: AC-4(6) + - reference-id: AC-6 + - reference-id: AC-20 + - reference-id: AC-20(1) + - reference-id: CM-5 + - reference-id: CM-7 assessment-requirements: - id: OSPS-AC-04.01 text: | diff --git a/baseline/OSPS-BR.yaml b/baseline/OSPS-BR.yaml index e885527f..58379dd5 100644 --- a/baseline/OSPS-BR.yaml +++ b/baseline/OSPS-BR.yaml @@ -18,45 +18,45 @@ controls: accessing privileged resources. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2f + entries: + - reference-id: 1.2f - reference-id: SSDF - identifiers: - - PO.3.2 - - PO.5.2 - - PS.1 - - PS.2 + entries: + - reference-id: PO.3.2 + - reference-id: PO.5.2 + - reference-id: PS.1 + - reference-id: PS.2 - reference-id: CSF - identifiers: - - PR.AA-02 + entries: + - reference-id: PR.AA-02 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 - - 357-352 + entries: + - reference-id: 486-813 + - reference-id: 124-564 + - reference-id: 357-352 - reference-id: SLSA - identifiers: - - Choose an appropriate build platform + entries: + - reference-id: Choose an appropriate build platform - reference-id: PSSCRM - identifiers: - - P2.3 - - P3.2 - - P3.5 - - E2.4 - - E2.5 - - D2.2 + entries: + - reference-id: P2.3 + - reference-id: P3.2 + - reference-id: P3.5 + - reference-id: E2.4 + - reference-id: E2.5 + - reference-id: D2.2 - reference-id: PCIDSS - identifiers: - - 2.2.1 - - 6.4.1 + entries: + - reference-id: 2.2.1 + - reference-id: 6.4.1 - reference-id: 800-161 - identifiers: - - AC-3 - - AC-4 - - AC-4(21) - - CM-5 - - CM-7 - - SI-7 + entries: + - reference-id: AC-3 + - reference-id: AC-4 + - reference-id: AC-4(21) + - reference-id: CM-5 + - reference-id: CM-7 + - reference-id: SI-7 assessment-requirements: - id: OSPS-BR-01.01 text: | @@ -88,45 +88,45 @@ controls: over time. guideline-mappings: - reference-id: BPB - identifiers: - - CC-B-5 - - CC-B-6 - - CC-B-7 + entries: + - reference-id: CC-B-5 + - reference-id: CC-B-6 + - reference-id: CC-B-7 - reference-id: CRA - identifiers: - - 1.2f + entries: + - reference-id: 1.2f - reference-id: SSDF - identifiers: - - PO.3.2 - - PS.1 - - PS.2 - - PS.3 + entries: + - reference-id: PO.3.2 + - reference-id: PS.1 + - reference-id: PS.2 + - reference-id: PS.3 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 + entries: + - reference-id: 486-813 + - reference-id: 124-564 - reference-id: SLSA - identifiers: - - Follow a consistent build process - - Provenance generation- Exists, Authentic + entries: + - reference-id: Follow a consistent build process + - reference-id: Provenance generation- Exists, Authentic - reference-id: PSSCRM - identifiers: - - G1.4 - - E1.2 - - E2.1 - - E2.6 + entries: + - reference-id: G1.4 + - reference-id: E1.2 + - reference-id: E2.1 + - reference-id: E2.6 - reference-id: PCIDSS - identifiers: - - 6.4.3 + entries: + - reference-id: 6.4.3 - reference-id: UKSSCOP - identifiers: - - 3.1 + entries: + - reference-id: 3.1 - reference-id: 800-161 - identifiers: - - IA-4 - - SA-15 - - SI-7 - - SR-4 + entries: + - reference-id: IA-4 + - reference-id: SA-15 + - reference-id: SI-7 + - reference-id: SR-4 assessment-requirements: - id: OSPS-BR-02.01 text: | @@ -159,51 +159,51 @@ controls: development, reducing the risk of eavesdropping or data tampering. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-11 + entries: + - reference-id: B-B-11 - reference-id: CRA - identifiers: - - 1.2d - - 1.2e - - 1.2f - - 1.2i - - 1.2j - - 1.2k + entries: + - reference-id: 1.2d + - reference-id: 1.2e + - reference-id: 1.2f + - reference-id: 1.2i + - reference-id: 1.2j + - reference-id: 1.2k - reference-id: SSDF - identifiers: - - PO.3.2 - - PO.5.2 - - PS.1 - - PS.2 + entries: + - reference-id: PO.3.2 + - reference-id: PO.5.2 + - reference-id: PS.1 + - reference-id: PS.2 - reference-id: OpenCRE - identifiers: - - 483-813 - - 124-564 - - 263-184 + entries: + - reference-id: 483-813 + - reference-id: 124-564 + - reference-id: 263-184 - reference-id: SLSA - identifiers: - - Choose an appropriate build platform + entries: + - reference-id: Choose an appropriate build platform - reference-id: PSSCRM - identifiers: - - E1.1 - - E2.2 - - E2.4 - - E2.5 + entries: + - reference-id: E1.1 + - reference-id: E2.2 + - reference-id: E2.4 + - reference-id: E2.5 - reference-id: PCIDSS - identifiers: - - 2.2.1 - - 2.2.7 - - 4.2.1 - - 4.2.2 - - 6.4.1 - - 8.3.2 + entries: + - reference-id: 2.2.1 + - reference-id: 2.2.7 + - reference-id: 4.2.1 + - reference-id: 4.2.2 + - reference-id: 6.4.1 + - reference-id: 8.3.2 - reference-id: UKSSCOP - identifiers: - - 3.1 + entries: + - reference-id: 3.1 - reference-id: 800-161 - identifiers: - - AC-4 - - AC-4(21) + entries: + - reference-id: AC-4 + - reference-id: AC-4(21) assessment-requirements: - id: OSPS-BR-03.01 text: | @@ -241,72 +241,72 @@ controls: improvements included in each release. guideline-mappings: - reference-id: BPB - identifiers: - - CC-B-8 - - CC-B-9 - - Q-B-7 - - A-B-1 - - A-S-1 + entries: + - reference-id: CC-B-8 + - reference-id: CC-B-9 + - reference-id: Q-B-7 + - reference-id: A-B-1 + - reference-id: A-S-1 - reference-id: CRA - identifiers: - - 1.2d - - 1.2f - - 1.2h - - 1.2j - - 1.2l - - 2.5 + entries: + - reference-id: 1.2d + - reference-id: 1.2f + - reference-id: 1.2h + - reference-id: 1.2j + - reference-id: 1.2l + - reference-id: 2.5 - reference-id: SSDF - identifiers: - - PS.1 - - PS.2 - - PS.3 - - PW.1.2 + entries: + - reference-id: PS.1 + - reference-id: PS.2 + - reference-id: PS.3 + - reference-id: PW.1.2 - reference-id: OpenCRE - identifiers: - - 483-813 - - 068-486 - - 124-564 - - 757-271 - - 347-352 - - 263-184 - - 208-355 - - 745-356 - - 732-148 + entries: + - reference-id: 483-813 + - reference-id: 068-486 + - reference-id: 124-564 + - reference-id: 757-271 + - reference-id: 347-352 + - reference-id: 263-184 + - reference-id: 208-355 + - reference-id: 745-356 + - reference-id: 732-148 - reference-id: SLSA - identifiers: - - Choose an appropriate build platform - - Follow a consistent build process - - Build platform - Isolation strength - isolated + entries: + - reference-id: Choose an appropriate build platform + - reference-id: Follow a consistent build process + - reference-id: Build platform - Isolation strength - isolated - reference-id: PSSCRM - identifiers: - - G1.4 - - E2.1 - - E2.4 - - E2.5 - - E3.1 - - E3.6 + entries: + - reference-id: G1.4 + - reference-id: E2.1 + - reference-id: E2.4 + - reference-id: E2.5 + - reference-id: E3.1 + - reference-id: E3.6 - reference-id: PCIDSS - identifiers: - - 6.2.1 - - 6.4.1 - - 6.5.1 - - 6.5.2 - - 10.2.2 + entries: + - reference-id: 6.2.1 + - reference-id: 6.4.1 + - reference-id: 6.5.1 + - reference-id: 6.5.2 + - reference-id: 10.2.2 - reference-id: UKSSCOP - identifiers: - - 3.1 - - 3.5 + entries: + - reference-id: 3.1 + - reference-id: 3.5 - reference-id: 800-161 - identifiers: - - AU-2 - - AU-6 - - AU-10 - - CM-5 - - CM-6 - - MA-1 - - MA-8 - - SI-4 - - SI-5 + entries: + - reference-id: AU-2 + - reference-id: AU-6 + - reference-id: AU-10 + - reference-id: CM-5 + - reference-id: CM-6 + - reference-id: MA-1 + - reference-id: MA-8 + - reference-id: SI-4 + - reference-id: SI-5 assessment-requirements: - id: OSPS-BR-04.01 text: | @@ -334,59 +334,59 @@ controls: issues or security vulnerabilities in the software. guideline-mappings: - reference-id: BPB - identifiers: - - Q-B-2 + entries: + - reference-id: Q-B-2 - reference-id: CRA - identifiers: - - 1.2b - - 1.2d - - 1.2f - - 1.2h - - 1.2j - - 2.1 - - 2.2 - - 2.3 + entries: + - reference-id: 1.2b + - reference-id: 1.2d + - reference-id: 1.2f + - reference-id: 1.2h + - reference-id: 1.2j + - reference-id: 2.1 + - reference-id: 2.2 + - reference-id: 2.3 - reference-id: SSDF - identifiers: - - PO.3.2 - - PS.1 - - PS.2 + entries: + - reference-id: PO.3.2 + - reference-id: PS.1 + - reference-id: PS.2 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 - - 347-352 - - 715-334 + entries: + - reference-id: 486-813 + - reference-id: 124-564 + - reference-id: 347-352 + - reference-id: 715-334 - reference-id: SLSA - identifiers: - - Isolation strength - isolated + entries: + - reference-id: Isolation strength - isolated - reference-id: PSSCRM - identifiers: - - P3.1 - - P3.5 - - E2.2 - - E2.3 - - E2.4 - - E2.5 + entries: + - reference-id: P3.1 + - reference-id: P3.5 + - reference-id: E2.2 + - reference-id: E2.3 + - reference-id: E2.4 + - reference-id: E2.5 - reference-id: SAMM - identifiers: - - Implementation -Secure Build -Build Process Lvl2 + entries: + - reference-id: Implementation -Secure Build -Build Process Lvl2 - reference-id: PCIDSS - identifiers: - - 6.4.3 + entries: + - reference-id: 6.4.3 - reference-id: UKSSCOP - identifiers: - - 1.1 - - 1.2 + entries: + - reference-id: 1.1 + - reference-id: 1.2 - reference-id: 800-161 - identifiers: - - AC-4 - - CM-2 - - CM-7(4) - - CM-7(5) - - RA-5 - - SA-15 - - SR-3 + entries: + - reference-id: AC-4 + - reference-id: CM-2 + - reference-id: CM-7(4) + - reference-id: CM-7(5) + - reference-id: RA-5 + - reference-id: SA-15 + - reference-id: SR-3 assessment-requirements: - id: OSPS-BR-05.01 text: | @@ -410,47 +410,47 @@ controls: signed manifest including each asset's cryptographic hashes. guideline-mappings: - reference-id: SSDF - identifiers: - - PO.5.2 - - PS.2 - - PS.2.1 - - PW.6.2 + entries: + - reference-id: PO.5.2 + - reference-id: PS.2 + - reference-id: PS.2.1 + - reference-id: PW.6.2 - reference-id: Scorecard - identifiers: - - Signed-Releases + entries: + - reference-id: Signed-Releases - reference-id: SLSA - identifiers: - - Distribute provenance - Exists + entries: + - reference-id: Distribute provenance - Exists - reference-id: PSSCRM - identifiers: - - P1.2 - - P3.2 - - P3.3 - - E2.1 - - E2.2 - - E2.6 + entries: + - reference-id: P1.2 + - reference-id: P3.2 + - reference-id: P3.3 + - reference-id: E2.1 + - reference-id: E2.2 + - reference-id: E2.6 - reference-id: SAMM - identifiers: - - Implementation -Secure Deployment -Deployment Process Lvl3 + entries: + - reference-id: Implementation -Secure Deployment -Deployment Process Lvl3 - reference-id: PCIDSS - identifiers: - - 2.2.1 - - 2.2.7 - - 3.5.1 - - 4.2.1 - - 4.2.2 - - 6.4.1 - - 8.3.2 + entries: + - reference-id: 2.2.1 + - reference-id: 2.2.7 + - reference-id: 3.5.1 + - reference-id: 4.2.1 + - reference-id: 4.2.2 + - reference-id: 6.4.1 + - reference-id: 8.3.2 - reference-id: UKSSCOP - identifiers: - - 3.1 + entries: + - reference-id: 3.1 - reference-id: 800-161 - identifiers: - - AU-10 - - MP-1 - - SA-15 - - SI-7 - - SI-7(14) + entries: + - reference-id: AU-10 + - reference-id: MP-1 + - reference-id: SA-15 + - reference-id: SI-7 + - reference-id: SI-7(14) assessment-requirements: - id: OSPS-BR-06.01 text: | diff --git a/baseline/OSPS-DO.yaml b/baseline/OSPS-DO.yaml index aafd73dc..22c3499d 100644 --- a/baseline/OSPS-DO.yaml +++ b/baseline/OSPS-DO.yaml @@ -18,55 +18,55 @@ controls: misconfiguration. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-1 - - B-B-9 - - B-S-7 - - B-S-9 + entries: + - reference-id: B-B-1 + - reference-id: B-B-9 + - reference-id: B-S-7 + - reference-id: B-S-9 - reference-id: CRA - identifiers: - - 1.2b - - 1.2j - - 1.2k + entries: + - reference-id: 1.2b + - reference-id: 1.2j + - reference-id: 1.2k - reference-id: SSDF - identifiers: - - PW.1.2 + entries: + - reference-id: PW.1.2 - reference-id: CSF - identifiers: - - GV.OC-04 - - GV.OC-05 + entries: + - reference-id: GV.OC-04 + - reference-id: GV.OC-05 - reference-id: ISO-18974 - identifiers: - - 4.1.4 + entries: + - reference-id: 4.1.4 - reference-id: OpenCRE - identifiers: - - 036-275 + entries: + - reference-id: 036-275 - reference-id: PSSCRM - identifiers: - - G5.1 - - E3.5 + entries: + - reference-id: G5.1 + - reference-id: E3.5 - reference-id: PCIDSS - identifiers: - - 2.1.1 - - 2.2.1 - - 3.1.1 - - 4.1.1 - - 5.1.1 - - 6.1.1 - - 6.2.1 - - 7.1.1 - - 8.1.1 - - 11.1.1 - - 12.10.5 + entries: + - reference-id: 2.1.1 + - reference-id: 2.2.1 + - reference-id: 3.1.1 + - reference-id: 4.1.1 + - reference-id: 5.1.1 + - reference-id: 6.1.1 + - reference-id: 6.2.1 + - reference-id: 7.1.1 + - reference-id: 8.1.1 + - reference-id: 11.1.1 + - reference-id: 12.10.5 - reference-id: UKSSCOP - identifiers: - - 4.1 + entries: + - reference-id: 4.1 - reference-id: 800-161 - identifiers: - - CM-2 - - PL-2 - - PL-8 - - SA-15 + entries: + - reference-id: CM-2 + - reference-id: PL-2 + - reference-id: PL-8 + - reference-id: SA-15 assessment-requirements: - id: OSPS-DO-01.01 text: | @@ -91,53 +91,53 @@ controls: defect fixes and improvements. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-3 - - R-B-1+ - - R-B-1 - - R-B-2 - - R-S-2 + entries: + - reference-id: B-B-3 + - reference-id: R-B-1+ + - reference-id: R-B-1 + - reference-id: R-B-2 + - reference-id: R-S-2 - reference-id: CRA - identifiers: - - 1.2c - - 1.2l - - 2.1 - - 2.2 - - 2.5 - - 2.6 + entries: + - reference-id: 1.2c + - reference-id: 1.2l + - reference-id: 2.1 + - reference-id: 2.2 + - reference-id: 2.5 + - reference-id: 2.6 - reference-id: SSDF - identifiers: - - PW.1.2 - - RV.1.1 - - RV.2.1 - - RV.1.2 + entries: + - reference-id: PW.1.2 + - reference-id: RV.1.1 + - reference-id: RV.2.1 + - reference-id: RV.1.2 - reference-id: CSF - identifiers: - - RS.MA-02 - - GV.RM-05 + entries: + - reference-id: RS.MA-02 + - reference-id: GV.RM-05 - reference-id: ISO-18974 - identifiers: - - 4.2.1 + entries: + - reference-id: 4.2.1 - reference-id: SAMM - identifiers: - - Implementation -Defect Management -Defect Tracking Lvl1 - - Implementation -Defect Management -Defect Tracking Lvl2 + entries: + - reference-id: Implementation -Defect Management -Defect Tracking Lvl1 + - reference-id: Implementation -Defect Management -Defect Tracking Lvl2 - reference-id: PCIDSS - identifiers: - - 6.3.2 - - 6.3.3 - - 6.5.1 - - 6.5.2 - - 12.10.2 + entries: + - reference-id: 6.3.2 + - reference-id: 6.3.3 + - reference-id: 6.5.1 + - reference-id: 6.5.2 + - reference-id: 12.10.2 - reference-id: UKSSCOP - identifiers: - - 1.1 - - 1.3 + entries: + - reference-id: 1.1 + - reference-id: 1.3 - reference-id: 800-161 - identifiers: - - IR-6 - - SI-4 - - SI-5 + entries: + - reference-id: IR-6 + - reference-id: SI-4 + - reference-id: SI-5 assessment-requirements: - id: OSPS-DO-02.01 text: | @@ -166,52 +166,52 @@ controls: unauthorized versions of the software. guideline-mappings: - reference-id: BPB - identifiers: - - CC-B-8 + entries: + - reference-id: CC-B-8 - reference-id: CRA - identifiers: - - 1.2d + entries: + - reference-id: 1.2d - reference-id: SSDF - identifiers: - - PO.4.2 - - PS.2 - - PS.2.1 - - PS.3.1 - - RV.1.3 + entries: + - reference-id: PO.4.2 + - reference-id: PS.2 + - reference-id: PS.2.1 + - reference-id: PS.3.1 + - reference-id: RV.1.3 - reference-id: OpenCRE - identifiers: - - 171-222 + entries: + - reference-id: 171-222 - reference-id: PSSCRM - identifiers: - - G1.3 - - G2.5 - - P1.2 - - P3.1 - - P3.2 - - P3.3 - - E2.6 + entries: + - reference-id: G1.3 + - reference-id: G2.5 + - reference-id: P1.2 + - reference-id: P3.1 + - reference-id: P3.2 + - reference-id: P3.3 + - reference-id: E2.6 - reference-id: PCIDSS - identifiers: - - 3.1.1 - - 3.5.1 - - 4.1.1 - - 5.1.1 - - 6.1.1 - - 6.2.1 - - 7.1.1 - - 8.1.1 - - 11.1.1 + entries: + - reference-id: 3.1.1 + - reference-id: 3.5.1 + - reference-id: 4.1.1 + - reference-id: 5.1.1 + - reference-id: 6.1.1 + - reference-id: 6.2.1 + - reference-id: 7.1.1 + - reference-id: 8.1.1 + - reference-id: 11.1.1 - reference-id: UKSSCOP - identifiers: - - 3.1 + entries: + - reference-id: 3.1 - reference-id: 800-161 - identifiers: - - CM-2 - - IR-1 - - MP-1 - - SA-15 - - SI-7 - - SI-7(14) + entries: + - reference-id: CM-2 + - reference-id: IR-1 + - reference-id: MP-1 + - reference-id: SA-15 + - reference-id: SI-7 + - reference-id: SI-7(14) assessment-requirements: - id: OSPS-DO-03.01 text: | @@ -253,44 +253,44 @@ controls: ensure the continued functionality and security of their systems. guideline-mappings: - reference-id: BPB - identifiers: - - R-B-3 + entries: + - reference-id: R-B-3 - reference-id: SSDF - identifiers: - - PO.4.2 - - PS.3.1 - - RV.1.3 + entries: + - reference-id: PO.4.2 + - reference-id: PS.3.1 + - reference-id: RV.1.3 - reference-id: ISO-18974 - identifiers: - - 4.1 - - 4.3.1 + entries: + - reference-id: 4.1 + - reference-id: 4.3.1 - reference-id: PSSCRM - identifiers: - - E1.6 + entries: + - reference-id: E1.6 - reference-id: SAMM - identifiers: - - Operations -Operational Management -System Decommissioning -Legacy Management Lvl1 + entries: + - reference-id: Operations -Operational Management -System Decommissioning -Legacy Management Lvl1 - reference-id: PCIDSS - identifiers: - - 2.1.1 - - 3.1.1 - - 3.2.1 - - 4.1.1 - - 5.1.1 - - 6.1.1 - - 6.3.3 - - 7.1.1 - - 8.1.1 - - 11.1.1 + entries: + - reference-id: 2.1.1 + - reference-id: 3.1.1 + - reference-id: 3.2.1 + - reference-id: 4.1.1 + - reference-id: 5.1.1 + - reference-id: 6.1.1 + - reference-id: 6.3.3 + - reference-id: 7.1.1 + - reference-id: 8.1.1 + - reference-id: 11.1.1 - reference-id: UKSSCOP - identifiers: - - 4.1 - - 4.2 + entries: + - reference-id: 4.1 + - reference-id: 4.2 - reference-id: 800-161 - identifiers: - - PL-1 - - PL-2 - - SI-4 + entries: + - reference-id: PL-1 + - reference-id: PL-2 + - reference-id: SI-4 assessment-requirements: - id: OSPS-DO-04.01 text: | @@ -318,45 +318,45 @@ controls: alternative solutions or alternative means of support for the project. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2c - - 2.6 + entries: + - reference-id: 1.2c + - reference-id: 2.6 - reference-id: ISO-18974 - identifiers: - - 4.1.1 - - 4.3.1 + entries: + - reference-id: 4.1.1 + - reference-id: 4.3.1 - reference-id: OpenCRE - identifiers: - - 673-475 - - 053-751 + entries: + - reference-id: 673-475 + - reference-id: 053-751 - reference-id: PSSCRM - identifiers: - - E1.6 + entries: + - reference-id: E1.6 - reference-id: SAMM - identifiers: - - Operations -Operational Management -System Decommissioning -Legacy Management Lvl1 - - Operations -Operational Management -System Decommissioning -Legacy Management Lvl2 + entries: + - reference-id: Operations -Operational Management -System Decommissioning -Legacy Management Lvl1 + - reference-id: Operations -Operational Management -System Decommissioning -Legacy Management Lvl2 - reference-id: PCIDSS - identifiers: - - 3.1.1 - - 3.2.1 - - 4.1.1 - - 5.1.1 - - 6.1.1 - - 6.3.2 - - 7.1.1 - - 8.1.1 - - 11.1.1 + entries: + - reference-id: 3.1.1 + - reference-id: 3.2.1 + - reference-id: 4.1.1 + - reference-id: 5.1.1 + - reference-id: 6.1.1 + - reference-id: 6.3.2 + - reference-id: 7.1.1 + - reference-id: 8.1.1 + - reference-id: 11.1.1 - reference-id: UKSSCOP - identifiers: - - 3.5 - - 4.1 + entries: + - reference-id: 3.5 + - reference-id: 4.1 - reference-id: 800-161 - identifiers: - - PL-1 - - PL-2 - - SI-4 - - SI-5 + entries: + - reference-id: PL-1 + - reference-id: PL-2 + - reference-id: SI-4 + - reference-id: SI-5 assessment-requirements: - id: OSPS-DO-05.01 text: | @@ -381,58 +381,58 @@ controls: that are required necessary for the software to function. guideline-mappings: - reference-id: BPB - identifiers: - - A-S-1 + entries: + - reference-id: A-S-1 - reference-id: CRA - identifiers: - - 2.1 + entries: + - reference-id: 2.1 - reference-id: OpenCRE - identifiers: - - 613-286 - - 053-751 + entries: + - reference-id: 613-286 + - reference-id: 053-751 - reference-id: Scorecard - identifiers: - - Pinned-Dependencies + entries: + - reference-id: Pinned-Dependencies - reference-id: PSSCRM - identifiers: - - G1.4 - - G2.4 - - P3.1 - - P3.2 - - P3.4 + entries: + - reference-id: G1.4 + - reference-id: G2.4 + - reference-id: P3.1 + - reference-id: P3.2 + - reference-id: P3.4 - reference-id: SAMM - identifiers: - - Design -Security Requirements -Supplier Security Lvl2 + entries: + - reference-id: Design -Security Requirements -Supplier Security Lvl2 - reference-id: PCIDSS - identifiers: - - 2.1.1 - - 3.1.1 - - 4.1.1 - - 5.1.1 - - 6.1.1 - - 6.3.2 - - 6.4.3 - - 7.1.1 - - 8.1.1 - - 11.1.1 - - 12.5.2 + entries: + - reference-id: 2.1.1 + - reference-id: 3.1.1 + - reference-id: 4.1.1 + - reference-id: 5.1.1 + - reference-id: 6.1.1 + - reference-id: 6.3.2 + - reference-id: 6.4.3 + - reference-id: 7.1.1 + - reference-id: 8.1.1 + - reference-id: 11.1.1 + - reference-id: 12.5.2 - reference-id: UKSSCOP - identifiers: - - 1.2 - - 3.3 + entries: + - reference-id: 1.2 + - reference-id: 3.3 - reference-id: 800-161 - identifiers: - - CA-7 - - CM-7(5) - - CM-8 - - PM-30 - - RA-3(1) - - SA-11 - - SI-4 - - SR-3 - - SR-5 - - SR-6 - - SR-7 + entries: + - reference-id: CA-7 + - reference-id: CM-7(5) + - reference-id: CM-8 + - reference-id: PM-30 + - reference-id: RA-3(1) + - reference-id: SA-11 + - reference-id: SI-4 + - reference-id: SR-3 + - reference-id: SR-5 + - reference-id: SR-6 + - reference-id: SR-7 assessment-requirements: - id: OSPS-DO-06.01 text: | diff --git a/baseline/OSPS-GV.yaml b/baseline/OSPS-GV.yaml index 0611e726..98bfdb3d 100644 --- a/baseline/OSPS-GV.yaml +++ b/baseline/OSPS-GV.yaml @@ -17,45 +17,45 @@ controls: they may have. guideline-mappings: - reference-id: BPB - identifiers: - - B-S-3 - - B-S-4 + entries: + - reference-id: B-S-3 + - reference-id: B-S-4 - reference-id: OpenCRE - identifiers: - - 013-021 + entries: + - reference-id: 013-021 - reference-id: PSSCRM - identifiers: - - G2.3 - - E3.1 - - E3.3 + entries: + - reference-id: G2.3 + - reference-id: E3.1 + - reference-id: E3.3 - reference-id: PCIDSS - identifiers: - - 2.1.2 - - 3.1.1 - - 3.1.2 - - 4.1.1 - - 4.1.2 - - 5.1.1 - - 5.1.2 - - 6.1.1 - - 6.1.2 - - 6.5.4 - - 7.1.1 - - 7.1.2 - - 8.1.1 - - 8.1.2 - - 11.1.1 - - 11.1.2 - - 12.1.3 - - 12.5.2 + entries: + - reference-id: 2.1.2 + - reference-id: 3.1.1 + - reference-id: 3.1.2 + - reference-id: 4.1.1 + - reference-id: 4.1.2 + - reference-id: 5.1.1 + - reference-id: 5.1.2 + - reference-id: 6.1.1 + - reference-id: 6.1.2 + - reference-id: 6.5.4 + - reference-id: 7.1.1 + - reference-id: 7.1.2 + - reference-id: 8.1.1 + - reference-id: 8.1.2 + - reference-id: 11.1.1 + - reference-id: 11.1.2 + - reference-id: 12.1.3 + - reference-id: 12.5.2 - reference-id: 800-161 - identifiers: - - AC-2 - - AC-3 - - IA-2 - - PL-1 - - PL-4 - - PM-30 + entries: + - reference-id: AC-2 + - reference-id: AC-3 + - reference-id: IA-2 + - reference-id: PL-1 + - reference-id: PL-4 + - reference-id: PM-30 assessment-requirements: - id: OSPS-GV-01.01 text: | @@ -92,27 +92,27 @@ controls: or usage challenges. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-3 - - B-B-12 + entries: + - reference-id: B-B-3 + - reference-id: B-B-12 - reference-id: CRA - identifiers: - - 1.2l - - 2.3 - - 2.4 - - 2.6 + entries: + - reference-id: 1.2l + - reference-id: 2.3 + - reference-id: 2.4 + - reference-id: 2.6 - reference-id: SSDF - identifiers: - - PS.3 - - PW.1.2 + entries: + - reference-id: PS.3 + - reference-id: PW.1.2 - reference-id: PCIDSS - identifiers: - - 12.5.2 + entries: + - reference-id: 12.5.2 - reference-id: 800-161 - identifiers: - - AC-21 - - AU-6 - - PL-1 + entries: + - reference-id: AC-21 + - reference-id: AU-6 + - reference-id: PL-1 assessment-requirements: - id: OSPS-GV-02.01 text: | @@ -137,37 +137,37 @@ controls: project's codebase. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-4 - - B-S-3 - - B-B-4+ - - R-B-1 - - Q-G-2 + entries: + - reference-id: B-B-4 + - reference-id: B-S-3 + - reference-id: B-B-4+ + - reference-id: R-B-1 + - reference-id: Q-G-2 - reference-id: CRA - identifiers: - - 1.2l - - 2.4 + entries: + - reference-id: 1.2l + - reference-id: 2.4 - reference-id: SSDF - identifiers: - - PW.1.2 + entries: + - reference-id: PW.1.2 - reference-id: ISO-18974 - identifiers: - - 4.1.2 + entries: + - reference-id: 4.1.2 - reference-id: PSSCRM - identifiers: - - G2.4 - - P2.2 + entries: + - reference-id: G2.4 + - reference-id: P2.2 - reference-id: PCIDSS - identifiers: - - 2.1.1 - - 6.5.4 - - 8.2.1 - - 12.5.2 + entries: + - reference-id: 2.1.1 + - reference-id: 6.5.4 + - reference-id: 8.2.1 + - reference-id: 12.5.2 - reference-id: 800-161 - identifiers: - - AC-3 - - AC-20 - - PL-1 + entries: + - reference-id: AC-3 + - reference-id: AC-20 + - reference-id: PL-1 assessment-requirements: - id: OSPS-GV-03.01 text: | @@ -206,56 +206,56 @@ controls: the risk of unauthorized access or misuse. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-5 - - B-S-3 - - B-B-4+ - - Q-G-2 + entries: + - reference-id: B-B-5 + - reference-id: B-S-3 + - reference-id: B-B-4+ + - reference-id: Q-G-2 - reference-id: CRA - identifiers: - - 1.2d - - 1.2l - - 2.1 - - 2.2 - - 2.5 - - 2.6 + entries: + - reference-id: 1.2d + - reference-id: 1.2l + - reference-id: 2.1 + - reference-id: 2.2 + - reference-id: 2.5 + - reference-id: 2.6 - reference-id: SSDF - identifiers: - - PO.2 - - PO.3.2 + entries: + - reference-id: PO.2 + - reference-id: PO.3.2 - reference-id: CSF - identifiers: - - PR.AA-02 - - PR.AA-05 + entries: + - reference-id: PR.AA-02 + - reference-id: PR.AA-05 - reference-id: OpenCRE - identifiers: - - 123-124 - - 152-725 + entries: + - reference-id: 123-124 + - reference-id: 152-725 - reference-id: ISO-18974 - identifiers: - - 4.1.2 + entries: + - reference-id: 4.1.2 - reference-id: PSSCRM - identifiers: - - E3.1 - - E3.3 + entries: + - reference-id: E3.1 + - reference-id: E3.3 - reference-id: PCIDSS - identifiers: - - 2.1.1 - - 6.5.4 - - 8.2.1 - - 8.2.2 + entries: + - reference-id: 2.1.1 + - reference-id: 6.5.4 + - reference-id: 8.2.1 + - reference-id: 8.2.2 - reference-id: 800-161 - identifiers: - - AC-2 - - AC-3 - - AC-4(21) - - AC-5 - - AC-6 - - AC-20 - - CM-7 - - IR-4(6) - - PM-30 - - SI-4 + entries: + - reference-id: AC-2 + - reference-id: AC-3 + - reference-id: AC-4(21) + - reference-id: AC-5 + - reference-id: AC-6 + - reference-id: AC-20 + - reference-id: CM-7 + - reference-id: IR-4(6) + - reference-id: PM-30 + - reference-id: SI-4 assessment-requirements: - id: OSPS-GV-04.01 text: | diff --git a/baseline/OSPS-LE.yaml b/baseline/OSPS-LE.yaml index 5fb73498..81bb679b 100644 --- a/baseline/OSPS-LE.yaml +++ b/baseline/OSPS-LE.yaml @@ -20,27 +20,27 @@ controls: the risk of intellectual property disputes against the project. guideline-mappings: - reference-id: BPB - identifiers: - - B-S-1 + entries: + - reference-id: B-S-1 - reference-id: CRA - identifiers: - - 1.2b - - 1.2f + entries: + - reference-id: 1.2b + - reference-id: 1.2f - reference-id: SSDF - identifiers: - - PO.3.2 - - PS.1 - - PW.1.2 - - PW.2.1 + entries: + - reference-id: PO.3.2 + - reference-id: PS.1 + - reference-id: PW.1.2 + - reference-id: PW.2.1 - reference-id: PSSCRM - identifiers: - - E3.1 + entries: + - reference-id: E3.1 - reference-id: PCIDSS - identifiers: - - 12.8.5 + entries: + - reference-id: 12.8.5 - reference-id: 800-161 - identifiers: - - PL-4 + entries: + - reference-id: PL-4 assessment-requirements: - id: OSPS-LE-01.01 text: | @@ -72,30 +72,30 @@ controls: how the code can be used and shared by others. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-6 - - B-B-7 + entries: + - reference-id: B-B-6 + - reference-id: B-B-7 - reference-id: CRA - identifiers: - - 1.2b + entries: + - reference-id: 1.2b - reference-id: SSDF - identifiers: - - PO.3.2 + entries: + - reference-id: PO.3.2 - reference-id: CSF - identifiers: - - GV.OC-03 + entries: + - reference-id: GV.OC-03 - reference-id: Scorecard - identifiers: - - License + entries: + - reference-id: License - reference-id: PSSCRM - identifiers: - - G1.2 + entries: + - reference-id: G1.2 - reference-id: PCIDSS - identifiers: - - 3.2.1 + entries: + - reference-id: 3.2.1 - reference-id: 800-161 - identifiers: - - PL-4 + entries: + - reference-id: PL-4 assessment-requirements: - id: OSPS-LE-02.01 text: | @@ -140,26 +140,26 @@ controls: and contributors how each can be used and shared. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-8 + entries: + - reference-id: B-B-8 - reference-id: CRA - identifiers: - - 1.2b + entries: + - reference-id: 1.2b - reference-id: SSDF - identifiers: - - PO.3.2 + entries: + - reference-id: PO.3.2 - reference-id: Scorecard - identifiers: - - License + entries: + - reference-id: License - reference-id: PSSCRM - identifiers: - - G1.2 + entries: + - reference-id: G1.2 - reference-id: PCIDSS - identifiers: - - 3.2.1 + entries: + - reference-id: 3.2.1 - reference-id: 800-161 - identifiers: - - PL-4 + entries: + - reference-id: PL-4 assessment-requirements: - id: OSPS-LE-03.01 text: | diff --git a/baseline/OSPS-QA.yaml b/baseline/OSPS-QA.yaml index 14ca982f..c1b98be9 100644 --- a/baseline/OSPS-QA.yaml +++ b/baseline/OSPS-QA.yaml @@ -18,57 +18,57 @@ controls: promoting transparency and collaboration within the project community. guideline-mappings: - reference-id: BPB - identifiers: - - CC-B-1 - - CC-B-2 - - CC-B-3 - - R-B-5 + entries: + - reference-id: CC-B-1 + - reference-id: CC-B-2 + - reference-id: CC-B-3 + - reference-id: R-B-5 - reference-id: CRA - identifiers: - - 1.2b - - 1.2f - - 1.2j + entries: + - reference-id: 1.2b + - reference-id: 1.2f + - reference-id: 1.2j - reference-id: SSDF - identifiers: - - PS.1 - - PS.2 - - PS.3 - - PW.1.2 - - PW.2.1 + entries: + - reference-id: PS.1 + - reference-id: PS.2 + - reference-id: PS.3 + - reference-id: PW.1.2 + - reference-id: PW.2.1 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 - - 757-271 + entries: + - reference-id: 486-813 + - reference-id: 124-564 + - reference-id: 757-271 - reference-id: CSF - identifiers: - - ID.AM-02 - - ID.RA-01 - - ID.RA-08 + entries: + - reference-id: ID.AM-02 + - reference-id: ID.RA-01 + - reference-id: ID.RA-08 - reference-id: ISO-18974 - identifiers: - - 4.1.4 + entries: + - reference-id: 4.1.4 - reference-id: SLSA - identifiers: - - Build platform - isolation strength - Isolated + entries: + - reference-id: Build platform - isolation strength - Isolated - reference-id: PSSCRM - identifiers: - - P3.5 - - E2.2 + entries: + - reference-id: P3.5 + - reference-id: E2.2 - reference-id: SAMM - identifiers: - - Implementation -Secure Build -Build Process Lvl1 + entries: + - reference-id: Implementation -Secure Build -Build Process Lvl1 - reference-id: PCIDSS - identifiers: - - 2.1.1 - - 6.2.1 - - 6.5.1 - - 6.5.2 + entries: + - reference-id: 2.1.1 + - reference-id: 6.2.1 + - reference-id: 6.5.1 + - reference-id: 6.5.2 - reference-id: 800-161 - identifiers: - - RA-5 - - SA-11 - - SA-15 + entries: + - reference-id: RA-5 + - reference-id: SA-11 + - reference-id: SA-15 assessment-requirements: - id: OSPS-QA-01.01 text: | @@ -107,70 +107,70 @@ controls: dependencies. guideline-mappings: - reference-id: BPB - identifiers: - - Q-S-8 - - Q-S-9 + entries: + - reference-id: Q-S-8 + - reference-id: Q-S-9 - reference-id: CRA - identifiers: - - 2.1 - - 2.2 - - 2.3 + entries: + - reference-id: 2.1 + - reference-id: 2.2 + - reference-id: 2.3 - reference-id: SSDF - identifiers: - - PO.3.3 - - PS.1 - - PS.2 - - PS.3.2 - - PW.4 + entries: + - reference-id: PO.3.3 + - reference-id: PS.1 + - reference-id: PS.2 + - reference-id: PS.3.2 + - reference-id: PW.4 - reference-id: CSF - identifiers: - - ID.AM.01 - - ID.AM-02 + entries: + - reference-id: ID.AM.01 + - reference-id: ID.AM-02 - reference-id: ISO-18974 - identifiers: - - 4.1.5 - - 4.3.1 + entries: + - reference-id: 4.1.5 + - reference-id: 4.3.1 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 - - 673-475 - - 863-521 - - 613-286 + entries: + - reference-id: 486-813 + - reference-id: 124-564 + - reference-id: 673-475 + - reference-id: 863-521 + - reference-id: 613-286 - reference-id: PSSCRM - identifiers: - - G1.4 - - G1.5 - - G2.5 - - P3.1 - - P3.2 - - P5.1 - - P5.2 - - E2.1 - - E2.2 + entries: + - reference-id: G1.4 + - reference-id: G1.5 + - reference-id: G2.5 + - reference-id: P3.1 + - reference-id: P3.2 + - reference-id: P5.1 + - reference-id: P5.2 + - reference-id: E2.1 + - reference-id: E2.2 - reference-id: SAMM - identifiers: - - Implementation -Secure Build -Software Dependencies Lvl1 + entries: + - reference-id: Implementation -Secure Build -Software Dependencies Lvl1 - reference-id: PCIDSS - identifiers: - - 6.3.2 - - 6.4.3 - - 12.5.1 + entries: + - reference-id: 6.3.2 + - reference-id: 6.4.3 + - reference-id: 12.5.1 - reference-id: UKSSCOP - identifiers: - - 1.2 + entries: + - reference-id: 1.2 - reference-id: 800-161 - identifiers: - - CA-7 - - CM-2 - - CM-8 - - PL-8 - - RA-3(1) - - RA-5 - - SA-11 - - SA-15 - - SR-3 - - SR-4 + entries: + - reference-id: CA-7 + - reference-id: CM-2 + - reference-id: CM-8 + - reference-id: PL-8 + - reference-id: RA-3(1) + - reference-id: RA-5 + - reference-id: SA-11 + - reference-id: SA-15 + - reference-id: SR-3 + - reference-id: SR-4 assessment-requirements: - id: OSPS-QA-02.01 text: | @@ -208,54 +208,54 @@ controls: checks. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2f - - 1.2k + entries: + - reference-id: 1.2f + - reference-id: 1.2k - reference-id: SSDF - identifiers: - - PO.4.1 - - PS.1 - - PS.2 - - RV.1.2 + entries: + - reference-id: PO.4.1 + - reference-id: PS.1 + - reference-id: PS.2 + - reference-id: RV.1.2 - reference-id: CSF - identifiers: - - ID.IM-02 + entries: + - reference-id: ID.IM-02 - reference-id: ISO-18974 - identifiers: - - 4.1.5 + entries: + - reference-id: 4.1.5 - reference-id: OpenCRE - identifiers: - - 263-184 - - 253-452 + entries: + - reference-id: 263-184 + - reference-id: 253-452 - reference-id: PSSCRM - identifiers: - - G2.2 - - G5.3 - - G5.4 - - P3.5 - - P4.1 - - P4.2 + entries: + - reference-id: G2.2 + - reference-id: G5.3 + - reference-id: G5.4 + - reference-id: P3.5 + - reference-id: P4.1 + - reference-id: P4.2 - reference-id: SAMM - identifiers: - - Implementation -Secure Build -Build Process Lvl3 - - Implementation -Secure Build -Software Dependencies Lvl3 - - Verification -Requirements Testing -Control Verification Lvl1 - - Verification -Requirements Testing -Control Verification Lvl2 - - Verification -Requirements Testing -Control Verification Lvl3 + entries: + - reference-id: Implementation -Secure Build -Build Process Lvl3 + - reference-id: Implementation -Secure Build -Software Dependencies Lvl3 + - reference-id: Verification -Requirements Testing -Control Verification Lvl1 + - reference-id: Verification -Requirements Testing -Control Verification Lvl2 + - reference-id: Verification -Requirements Testing -Control Verification Lvl3 - reference-id: PCIDSS - identifiers: - - 6.3.1 - - 6.3.2 - - 6.5.2 + entries: + - reference-id: 6.3.1 + - reference-id: 6.3.2 + - reference-id: 6.5.2 - reference-id: 800-161 - identifiers: - - AU-6 - - CM-3 - - CM-6 - - PL-8 - - SA-11 - - SA-15 - - SR-3 + entries: + - reference-id: AU-6 + - reference-id: CM-3 + - reference-id: CM-6 + - reference-id: PL-8 + - reference-id: SA-11 + - reference-id: SA-15 + - reference-id: SR-3 assessment-requirements: - id: OSPS-QA-03.01 text: | @@ -282,37 +282,37 @@ controls: codebase. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2b - - 1.2f + entries: + - reference-id: 1.2b + - reference-id: 1.2f - reference-id: SSDF - identifiers: - - PO.3.2 - - PO.4.1 - - PS.1 - - PS.2 - - RV.1.2 + entries: + - reference-id: PO.3.2 + - reference-id: PO.4.1 + - reference-id: PS.1 + - reference-id: PS.2 + - reference-id: RV.1.2 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 + entries: + - reference-id: 486-813 + - reference-id: 124-564 - reference-id: SLSA - identifiers: - - Build platform - isolation strength - Isolated + entries: + - reference-id: Build platform - isolation strength - Isolated - reference-id: Scorecard - identifiers: - - Binary-Artifacts + entries: + - reference-id: Binary-Artifacts - reference-id: PSSCRM - identifiers: - - G2.2 - - G5.4 + entries: + - reference-id: G2.2 + - reference-id: G5.4 - reference-id: PCIDSS - identifiers: - - 6.4.2 + entries: + - reference-id: 6.4.2 - reference-id: 800-161 - identifiers: - - PL-8 - - SA-15 + entries: + - reference-id: PL-8 + - reference-id: SA-15 assessment-requirements: - id: OSPS-QA-04.01 text: | @@ -352,24 +352,24 @@ controls: necessary files are stored in the repository. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2b + entries: + - reference-id: 1.2b - reference-id: SSDF - identifiers: - - PS.1 - - PS.2 + entries: + - reference-id: PS.1 + - reference-id: PS.2 - reference-id: OpenCRE - identifiers: - - 486-813 - - 124-564 + entries: + - reference-id: 486-813 + - reference-id: 124-564 - reference-id: PCIDSS - identifiers: - - 6.4.3 + entries: + - reference-id: 6.4.3 - reference-id: 800-161 - identifiers: - - PL-8 - - SA-15 - - SR-3 + entries: + - reference-id: PL-8 + - reference-id: SA-15 + - reference-id: SR-3 assessment-requirements: - id: OSPS-QA-05.01 text: | @@ -409,56 +409,56 @@ controls: source code repository and clearly documents when and how tests are run. guideline-mappings: - reference-id: BPB - identifiers: - - Q-B-4 - - Q-B-8 - - Q-B-9 - - Q-B-10 - - Q-S-2 + entries: + - reference-id: Q-B-4 + - reference-id: Q-B-8 + - reference-id: Q-B-9 + - reference-id: Q-B-10 + - reference-id: Q-S-2 - reference-id: CRA - identifiers: - - 2.3 + entries: + - reference-id: 2.3 - reference-id: SSDF - identifiers: - - PW.8.2 + entries: + - reference-id: PW.8.2 - reference-id: CSF - identifiers: - - ID.AM-02 + entries: + - reference-id: ID.AM-02 - reference-id: ISO-18974 - identifiers: - - 4.1.5 + entries: + - reference-id: 4.1.5 - reference-id: OpenCRE - identifiers: - - 207-435 - - 088-377 + entries: + - reference-id: 207-435 + - reference-id: 088-377 - reference-id: Scorecard - identifiers: - - CI-Tests + entries: + - reference-id: CI-Tests - reference-id: PSSCRM - identifiers: - - P4.1 - - P4.2 - - P4.3 - - P4.4 - - E2.4 - - E2.5 + entries: + - reference-id: P4.1 + - reference-id: P4.2 + - reference-id: P4.3 + - reference-id: P4.4 + - reference-id: E2.4 + - reference-id: E2.5 - reference-id: SAMM - identifiers: - - Verification-Requirements -Testing -Control Verification Lvl1 - - Verification-Requirements -Testing -Control Verification Lvl2 - - Verification-Requirements -Testing -Control Verification Lvl3 - - Verification -Security Testing -Scalable Baseline Lvl3 + entries: + - reference-id: Verification-Requirements -Testing -Control Verification Lvl1 + - reference-id: Verification-Requirements -Testing -Control Verification Lvl2 + - reference-id: Verification-Requirements -Testing -Control Verification Lvl3 + - reference-id: Verification -Security Testing -Scalable Baseline Lvl3 - reference-id: PCIDSS - identifiers: - - 6.2.3 - - 6.3.1 - - 6.3.2 - - 6.4.2 + entries: + - reference-id: 6.2.3 + - reference-id: 6.3.1 + - reference-id: 6.3.2 + - reference-id: 6.4.2 - reference-id: 800-161 - identifiers: - - SA-11 - - SA-15 - - SR-3 + entries: + - reference-id: SA-11 + - reference-id: SA-15 + - reference-id: SR-3 assessment-requirements: - id: OSPS-QA-06.01 text: | @@ -509,28 +509,28 @@ controls: branch. guideline-mappings: - reference-id: BPB - identifiers: - - B-G-3 + entries: + - reference-id: B-G-3 - reference-id: Scorecard - identifiers: - - Code-Review + entries: + - reference-id: Code-Review - reference-id: PSSCRM - identifiers: - - G2.4 - - P3.3 - - P3.5 + entries: + - reference-id: G2.4 + - reference-id: P3.3 + - reference-id: P3.5 - reference-id: PCIDSS - identifiers: - - 6.2.3.1 - - 6.4.2 - - 6.5.4 + entries: + - reference-id: 6.2.3.1 + - reference-id: 6.4.2 + - reference-id: 6.5.4 - reference-id: 800-161 - identifiers: - - AC-5 - - AU-6 - - PL-8 - - SA-15 - - SR-3 + entries: + - reference-id: AC-5 + - reference-id: AU-6 + - reference-id: PL-8 + - reference-id: SA-15 + - reference-id: SR-3 assessment-requirements: - id: OSPS-QA-07.01 text: | diff --git a/baseline/OSPS-SA.yaml b/baseline/OSPS-SA.yaml index e131b800..5d945d4b 100644 --- a/baseline/OSPS-SA.yaml +++ b/baseline/OSPS-SA.yaml @@ -16,64 +16,64 @@ controls: assets. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-1 - - B-S-7 - - B-S-8 + entries: + - reference-id: B-B-1 + - reference-id: B-S-7 + - reference-id: B-S-8 - reference-id: CRA - identifiers: - - 1.2a - - 1.2b + entries: + - reference-id: 1.2a + - reference-id: 1.2b - reference-id: SSDF - identifiers: - - PO.1 - - PO.2 - - PO.3.2 + entries: + - reference-id: PO.1 + - reference-id: PO.2 + - reference-id: PO.3.2 - reference-id: CSF - identifiers: - - ID.AM-02 + entries: + - reference-id: ID.AM-02 - reference-id: OpenCRE - identifiers: - - 155-155 - - 326-704 - - 068-102 - - 036-275 - - 162-655 + entries: + - reference-id: 155-155 + - reference-id: 326-704 + - reference-id: 068-102 + - reference-id: 036-275 + - reference-id: 162-655 - reference-id: PSSCRM - identifiers: - - G5.1 - - P1.1 - - E3.4 - - E3.7 + entries: + - reference-id: G5.1 + - reference-id: P1.1 + - reference-id: E3.4 + - reference-id: E3.7 - reference-id: SAMM - identifiers: - - Operations -Operational Management -Data Protection Lvl2 + entries: + - reference-id: Operations -Operational Management -Data Protection Lvl2 - reference-id: PCIDSS - identifiers: - - 2.2.1 - - 2.2.3 - - 2.2.4 - - 2.2.5 - - 2.2.6 - - 3.1.1 - - 4.1.1 - - 5.1.1 - - 6.1.1 - - 6.2.1 - - 7.1.1 - - 8.1.1 - - 11.1.1 - - 12.3.1 - - 12.5.3 + entries: + - reference-id: 2.2.1 + - reference-id: 2.2.3 + - reference-id: 2.2.4 + - reference-id: 2.2.5 + - reference-id: 2.2.6 + - reference-id: 3.1.1 + - reference-id: 4.1.1 + - reference-id: 5.1.1 + - reference-id: 6.1.1 + - reference-id: 6.2.1 + - reference-id: 7.1.1 + - reference-id: 8.1.1 + - reference-id: 11.1.1 + - reference-id: 12.3.1 + - reference-id: 12.5.3 - reference-id: UKSSCOP - identifiers: - - 1.4 + entries: + - reference-id: 1.4 - reference-id: 800-161 - identifiers: - - CM-2 - - PL-8 - - RA-3 - - SA-15 + entries: + - reference-id: CM-2 + - reference-id: PL-8 + - reference-id: RA-3 + - reference-id: SA-15 assessment-requirements: - id: OSPS-SA-01.01 text: | @@ -100,50 +100,50 @@ controls: to use the software effectively. guideline-mappings: - reference-id: BPB - identifiers: - - B-B-10 - - B-S-7 + entries: + - reference-id: B-B-10 + - reference-id: B-S-7 - reference-id: CRA - identifiers: - - 1.2a - - 1.2b + entries: + - reference-id: 1.2a + - reference-id: 1.2b - reference-id: SSDF - identifiers: - - PW.1.2 + entries: + - reference-id: PW.1.2 - reference-id: CSF - identifiers: - - GV.OC-05 - - ID.AM-01 + entries: + - reference-id: GV.OC-05 + - reference-id: ID.AM-01 - reference-id: ISO-18974 - identifiers: - - 4.1.4 + entries: + - reference-id: 4.1.4 - reference-id: OpenCRE - identifiers: - - 155-155 - - 068-102 - - 072-713 - - 820-878 + entries: + - reference-id: 155-155 + - reference-id: 068-102 + - reference-id: 072-713 + - reference-id: 820-878 - reference-id: PSSCRM - identifiers: - - E3.4 - - E3.7 + entries: + - reference-id: E3.4 + - reference-id: E3.7 - reference-id: PCIDSS - identifiers: - - 2.2.1 - - 2.2.3 - - 2.2.4 - - 2.2.5 - - 2.2.6 - - 6.2.1 - - 12.3.1 - - 12.8.1 + entries: + - reference-id: 2.2.1 + - reference-id: 2.2.3 + - reference-id: 2.2.4 + - reference-id: 2.2.5 + - reference-id: 2.2.6 + - reference-id: 6.2.1 + - reference-id: 12.3.1 + - reference-id: 12.8.1 - reference-id: 800-161 - identifiers: - - CM-2 - - PL-2 - - PL-8 - - RA-3 - - SA-15 + entries: + - reference-id: CM-2 + - reference-id: PL-2 + - reference-id: PL-8 + - reference-id: RA-3 + - reference-id: SA-15 assessment-requirements: - id: OSPS-SA-02.01 text: | @@ -168,74 +168,74 @@ controls: of those threats from occurring. guideline-mappings: - reference-id: BPB - identifiers: - - B-S-8 - - S-G-1 + entries: + - reference-id: B-S-8 + - reference-id: S-G-1 - reference-id: CRA - identifiers: - - 1.1 - - 1.2j - - 1.2k - - 2.2 + entries: + - reference-id: 1.1 + - reference-id: 1.2j + - reference-id: 1.2k + - reference-id: 2.2 - reference-id: SSDF - identifiers: - - PO.5.1 - - PW.1.1 + entries: + - reference-id: PO.5.1 + - reference-id: PW.1.1 - reference-id: CSF - identifiers: - - ID.RA-01 - - ID.RA-04 - - ID.RA-05 - - DE.AE-07 + entries: + - reference-id: ID.RA-01 + - reference-id: ID.RA-04 + - reference-id: ID.RA-05 + - reference-id: DE.AE-07 - reference-id: ISO-18974 - identifiers: - - 4.1.5 + entries: + - reference-id: 4.1.5 - reference-id: OpenCRE - identifiers: - - 068-102 - - 154-031 - - 888-770 + entries: + - reference-id: 068-102 + - reference-id: 154-031 + - reference-id: 888-770 - reference-id: PSSCRM - identifiers: - - G4.3 - - G5.2 - - P2.1 + entries: + - reference-id: G4.3 + - reference-id: G5.2 + - reference-id: P2.1 - reference-id: SAMM - identifiers: - - Governance -Create and Promote Lvl1 - - Design -Threat Assessment -Application Risk Profile Lvl1 - - Design -Threat Assessment -Threat Modeling Lvl1 - - Verification -Architecture Assessment -Architecture Mitigation Lvl2 + entries: + - reference-id: Governance -Create and Promote Lvl1 + - reference-id: Design -Threat Assessment -Application Risk Profile Lvl1 + - reference-id: Design -Threat Assessment -Threat Modeling Lvl1 + - reference-id: Verification -Architecture Assessment -Architecture Mitigation Lvl2 - reference-id: PCIDSS - identifiers: - - 2.2.4 - - 2.2.5 - - 2.2.6 - - 6.2.1 - - 6.2.3.1 - - 6.3.2 - - 6.4.2 - - 11.3.1 - - 12.3.1 + entries: + - reference-id: 2.2.4 + - reference-id: 2.2.5 + - reference-id: 2.2.6 + - reference-id: 6.2.1 + - reference-id: 6.2.3.1 + - reference-id: 6.3.2 + - reference-id: 6.4.2 + - reference-id: 11.3.1 + - reference-id: 12.3.1 - reference-id: UKSSCOP - identifiers: - - 1.4 - - 3.3 + entries: + - reference-id: 1.4 + - reference-id: 3.3 - reference-id: 800-161 - identifiers: - - CA-2 - - CA-2(3) - - PM-30 - - RA-3 - - SA-11 - - SA-15 - - SA-15(3) - - SA-15(8) - - SI-3 - - SR-3 - - SR-3(3) - - SR-6 - - SR-7 + entries: + - reference-id: CA-2 + - reference-id: CA-2(3) + - reference-id: PM-30 + - reference-id: RA-3 + - reference-id: SA-11 + - reference-id: SA-15 + - reference-id: SA-15(3) + - reference-id: SA-15(8) + - reference-id: SI-3 + - reference-id: SR-3 + - reference-id: SR-3(3) + - reference-id: SR-6 + - reference-id: SR-7 assessment-requirements: - id: OSPS-SA-03.01 text: | diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index 1f9de896..fd419f39 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -17,84 +17,84 @@ controls: transparently. guideline-mappings: - reference-id: BPB - identifiers: - - R-B-6 - - R-B-8 - - R-S-2 - - S-B-14 - - S-B-15 + entries: + - reference-id: R-B-6 + - reference-id: R-B-8 + - reference-id: R-S-2 + - reference-id: S-B-14 + - reference-id: S-B-15 - reference-id: CRA - identifiers: - - 2.1 - - 2.2 - - 2.3 - - 2.6 - - 2.7 - - 2.8 + entries: + - reference-id: 2.1 + - reference-id: 2.2 + - reference-id: 2.3 + - reference-id: 2.6 + - reference-id: 2.7 + - reference-id: 2.8 - reference-id: SSDF - identifiers: - - RV.1.3 + entries: + - reference-id: RV.1.3 - reference-id: CSF - identifiers: - - GV.PO-01 - - GV.PO-02 - - ID.RA-01 - - ID.RA-08 + entries: + - reference-id: GV.PO-01 + - reference-id: GV.PO-02 + - reference-id: ID.RA-01 + - reference-id: ID.RA-08 - reference-id: ISO-18974 - identifiers: - - 4.1.5 - - 4.2.1 - - 4.3.2 + entries: + - reference-id: 4.1.5 + - reference-id: 4.2.1 + - reference-id: 4.3.2 - reference-id: OpenCRE - identifiers: - - 887-750 + entries: + - reference-id: 887-750 - reference-id: Scorecard - identifiers: - - Security-Policy + entries: + - reference-id: Security-Policy - reference-id: PSSCRM - identifiers: - - D1.1 - - D1.2 - - D1.3 - - D1.5 + entries: + - reference-id: D1.1 + - reference-id: D1.2 + - reference-id: D1.3 + - reference-id: D1.5 - reference-id: SAMM - identifiers: - - Governance -Create and Promote Lvl2 - - Governance -Policy & Compliance -Policy & Standards Lvl1 - - Implementation -Defect Management -Defect Tracking Lvl1 - - Implementation -Defect Management -Defect Tracking Lvl2 - - Implementation -Defect Management -Defect Tracking Lvl3 - - Operations -Incident Management -Incident Response Lvl1 - - Operations -Incident Management -Incident Response Lvl2 - - Operations -Incident Management -Incident Response Lvl3 + entries: + - reference-id: Governance -Create and Promote Lvl2 + - reference-id: Governance -Policy & Compliance -Policy & Standards Lvl1 + - reference-id: Implementation -Defect Management -Defect Tracking Lvl1 + - reference-id: Implementation -Defect Management -Defect Tracking Lvl2 + - reference-id: Implementation -Defect Management -Defect Tracking Lvl3 + - reference-id: Operations -Incident Management -Incident Response Lvl1 + - reference-id: Operations -Incident Management -Incident Response Lvl2 + - reference-id: Operations -Incident Management -Incident Response Lvl3 - reference-id: PCIDSS - identifiers: - - 2.1.1 - - 3.1.1 - - 4.1.1 - - 5.1.1 - - 6.1.1 - - 6.3.1 - - 6.3.2 - - 7.1.1 - - 8.1.1 - - 11.1.1 - - 11.2.1 - - 12.1.1 - - 12.1.3 + entries: + - reference-id: 2.1.1 + - reference-id: 3.1.1 + - reference-id: 4.1.1 + - reference-id: 5.1.1 + - reference-id: 6.1.1 + - reference-id: 6.3.1 + - reference-id: 6.3.2 + - reference-id: 7.1.1 + - reference-id: 8.1.1 + - reference-id: 11.1.1 + - reference-id: 11.2.1 + - reference-id: 12.1.1 + - reference-id: 12.1.3 - reference-id: UKSSCOP - identifiers: - - 3.2 - - 3.4 - - 3.5 + entries: + - reference-id: 3.2 + - reference-id: 3.4 + - reference-id: 3.5 - reference-id: 800-161 - identifiers: - - IR-1 - - IR-4 - - IR-6 - - IR-7(1) - - IR-8 - - SI-2 + entries: + - reference-id: IR-1 + - reference-id: IR-4 + - reference-id: IR-6 + - reference-id: IR-7(1) + - reference-id: IR-8 + - reference-id: SI-2 assessment-requirements: - id: OSPS-VM-01.01 text: | @@ -121,48 +121,48 @@ controls: the report to the project. guideline-mappings: - reference-id: BPB - identifiers: - - B-S-8 + entries: + - reference-id: B-S-8 - reference-id: CRA - identifiers: - - 2.5 + entries: + - reference-id: 2.5 - reference-id: SSDF - identifiers: - - RV.1.3 + entries: + - reference-id: RV.1.3 - reference-id: CSF - identifiers: - - GV.PO-01 - - GV.PO-02 - - ID.RA-01 + entries: + - reference-id: GV.PO-01 + - reference-id: GV.PO-02 + - reference-id: ID.RA-01 - reference-id: ISO-18974 - identifiers: - - 4.1.1 - - 4.1.3 - - 4.1.5 - - 4.2.2 + entries: + - reference-id: 4.1.1 + - reference-id: 4.1.3 + - reference-id: 4.1.5 + - reference-id: 4.2.2 - reference-id: OpenCRE - identifiers: - - 464-513 + entries: + - reference-id: 464-513 - reference-id: Scorecard - identifiers: - - Security-Policy + entries: + - reference-id: Security-Policy - reference-id: SAMM - identifiers: - - Governance -Policy&Compliance -Policy&Standards Lvl2 + entries: + - reference-id: Governance -Policy&Compliance -Policy&Standards Lvl2 - reference-id: PCIDSS - identifiers: - - 6.3.3 - - 12.1.1 - - 12.10.2 + entries: + - reference-id: 6.3.3 + - reference-id: 12.1.1 + - reference-id: 12.10.2 - reference-id: UKSSCOP - identifiers: - - 3.2 + entries: + - reference-id: 3.2 - reference-id: 800-161 - identifiers: - - IR-1 - - IR-4 - - IR-6 - - IR-8 + entries: + - reference-id: IR-1 + - reference-id: IR-4 + - reference-id: IR-6 + - reference-id: IR-8 assessment-requirements: - id: OSPS-VM-02.01 text: | @@ -184,29 +184,29 @@ controls: remediations to protect users of the project. guideline-mappings: - reference-id: BPB - identifiers: - - R-B-7 + entries: + - reference-id: R-B-7 - reference-id: CRA - identifiers: - - 2.5 - - 2.6 + entries: + - reference-id: 2.5 + - reference-id: 2.6 - reference-id: OpenCRE - identifiers: - - 308-514 + entries: + - reference-id: 308-514 - reference-id: SAMM - identifiers: - - Operations -Incident Management -Incident Response Lvl3 + entries: + - reference-id: Operations -Incident Management -Incident Response Lvl3 - reference-id: PCIDSS - identifiers: - - 6.3.1 - - 6.3.3 - - 12.10.2 + entries: + - reference-id: 6.3.1 + - reference-id: 6.3.3 + - reference-id: 12.10.2 - reference-id: UKSSCOP - identifiers: - - 3.2 + entries: + - reference-id: 3.2 - reference-id: 800-161 - identifiers: - - IR-6 + entries: + - reference-id: IR-6 assessment-requirements: - id: OSPS-VM-03.01 text: | @@ -230,48 +230,48 @@ controls: found within the project. guideline-mappings: - reference-id: CRA - identifiers: - - 1.2a - - 1.2b - - 2.1 - - 2.4 - - 2.6 + entries: + - reference-id: 1.2a + - reference-id: 1.2b + - reference-id: 2.1 + - reference-id: 2.4 + - reference-id: 2.6 - reference-id: SSDF - identifiers: - - PO.4.1 - - RV.2.1 - - RV.2.2 + entries: + - reference-id: PO.4.1 + - reference-id: RV.2.1 + - reference-id: RV.2.2 - reference-id: CSF - identifiers: - - ID.RA-01 + entries: + - reference-id: ID.RA-01 - reference-id: ISO-18974 - identifiers: - - 4.1.5 + entries: + - reference-id: 4.1.5 - reference-id: PSSCRM - identifiers: - - G2.2 - - D1.1 + entries: + - reference-id: G2.2 + - reference-id: D1.1 - reference-id: PCIDSS - identifiers: - - 6.2.3 - - 6.3.1 - - 6.3.2 - - 6.3.3 - - 11.3.1 + entries: + - reference-id: 6.2.3 + - reference-id: 6.3.1 + - reference-id: 6.3.2 + - reference-id: 6.3.3 + - reference-id: 11.3.1 - reference-id: UKSSCOP - identifiers: - - 3.4 - - 3.5 - - 4.3 + entries: + - reference-id: 3.4 + - reference-id: 3.5 + - reference-id: 4.3 - reference-id: 800-161 - identifiers: - - CA-7 - - CM-3 - - CM-8 - - IR-5 - - SI-2 - - SI-4 - - SI-5 + entries: + - reference-id: CA-7 + - reference-id: CM-3 + - reference-id: CM-8 + - reference-id: IR-5 + - reference-id: SI-2 + - reference-id: SI-4 + - reference-id: SI-5 assessment-requirements: - id: OSPS-VM-04.01 text: | @@ -313,94 +313,94 @@ controls: malicious. guideline-mappings: - reference-id: BPB - identifiers: - - B-S-8 - - Q-B-12 - - Q-S-9 - - S-B-14 - - S-B-15 - - A-B-1 - - A-B-3 - - A-B-8 - - A-S-1 + entries: + - reference-id: B-S-8 + - reference-id: Q-B-12 + - reference-id: Q-S-9 + - reference-id: S-B-14 + - reference-id: S-B-15 + - reference-id: A-B-1 + - reference-id: A-B-3 + - reference-id: A-B-8 + - reference-id: A-S-1 - reference-id: CRA - identifiers: - - 1.2a - - 1.2b - - 1.2c - - 2.1 - - 2.2 - - 2.3 - - 2.4 + entries: + - reference-id: 1.2a + - reference-id: 1.2b + - reference-id: 1.2c + - reference-id: 2.1 + - reference-id: 2.2 + - reference-id: 2.3 + - reference-id: 2.4 - reference-id: SSDF - identifiers: - - PO.4 - - PW.1.2 - - PW.8.1 - - RV.1.2 - - RV.1.3 - - RV.2.1 - - RV.2.2 + entries: + - reference-id: PO.4 + - reference-id: PW.1.2 + - reference-id: PW.8.1 + - reference-id: RV.1.2 + - reference-id: RV.1.3 + - reference-id: RV.2.1 + - reference-id: RV.2.2 - reference-id: CSF - identifiers: - - GV.RM-05 - - GV.RM-06 - - GV.PO-01 - - GV.PO-02 - - ID.RA-01 - - ID.RA-08 - - ID.IM-02 + entries: + - reference-id: GV.RM-05 + - reference-id: GV.RM-06 + - reference-id: GV.PO-01 + - reference-id: GV.PO-02 + - reference-id: ID.RA-01 + - reference-id: ID.RA-08 + - reference-id: ID.IM-02 - reference-id: ISO-18974 - identifiers: - - 4.1.5 - - 4.2.1 - - 4.2.2 - - 4.3.2 + entries: + - reference-id: 4.1.5 + - reference-id: 4.2.1 + - reference-id: 4.2.2 + - reference-id: 4.3.2 - reference-id: OpenCRE - identifiers: - - 155-155 - - 124-564 - - 757-271 - - 464-513 - - 611-158 - - 207-435 - - 088-377 + entries: + - reference-id: 155-155 + - reference-id: 124-564 + - reference-id: 757-271 + - reference-id: 464-513 + - reference-id: 611-158 + - reference-id: 207-435 + - reference-id: 088-377 - reference-id: Scorecard - identifiers: - - Security-Policy - - Vulnerabilities + entries: + - reference-id: Security-Policy + - reference-id: Vulnerabilities - reference-id: PSSCRM - identifiers: - - G5.4 - - P4.1 - - P4.2 - - P4.3 - - P4.4 - - P4.5 + entries: + - reference-id: G5.4 + - reference-id: P4.1 + - reference-id: P4.2 + - reference-id: P4.3 + - reference-id: P4.4 + - reference-id: P4.5 - reference-id: SAMM - identifiers: - - Implementation -Secure Build-Build Process Lvl3 - - Implementation -Software Dependencies Lvl3 - - Verification -Security Testing -Scalable Baseline Lvl1 - - Verification -Security Testing -Scalable Baseline Lvl3 + entries: + - reference-id: Implementation -Secure Build-Build Process Lvl3 + - reference-id: Implementation -Software Dependencies Lvl3 + - reference-id: Verification -Security Testing -Scalable Baseline Lvl1 + - reference-id: Verification -Security Testing -Scalable Baseline Lvl3 - reference-id: PCIDSS - identifiers: - - 6.2.3 - - 6.3.1 - - 6.3.2 - - 6.4.1 - - 6.4.2 + entries: + - reference-id: 6.2.3 + - reference-id: 6.3.1 + - reference-id: 6.3.2 + - reference-id: 6.4.1 + - reference-id: 6.4.2 - reference-id: UKSSCOP - identifiers: - - 1.2 - - 3.3 + entries: + - reference-id: 1.2 + - reference-id: 3.3 - reference-id: 800-161 - identifiers: - - CA-7 - - RA-5 - - SA-11 - - SI-2 - - SI-3 + entries: + - reference-id: CA-7 + - reference-id: RA-5 + - reference-id: SA-11 + - reference-id: SI-2 + - reference-id: SI-3 assessment-requirements: - id: OSPS-VM-05.01 text: | @@ -449,96 +449,96 @@ controls: insecure software. guideline-mappings: - reference-id: BPB - identifiers: - - B-S-8 - - Q-B-12 - - Q-S-9 - - S-B-14 - - S-B-15 - - A-B-1 - - A-B-3 - - A-B-8 - - A-S-1 + entries: + - reference-id: B-S-8 + - reference-id: Q-B-12 + - reference-id: Q-S-9 + - reference-id: S-B-14 + - reference-id: S-B-15 + - reference-id: A-B-1 + - reference-id: A-B-3 + - reference-id: A-B-8 + - reference-id: A-S-1 - reference-id: CRA - identifiers: - - 1.2a - - 1.2b - - 1.2c - - 2.1 - - 2.2 - - 2.3 - - 2.4 + entries: + - reference-id: 1.2a + - reference-id: 1.2b + - reference-id: 1.2c + - reference-id: 2.1 + - reference-id: 2.2 + - reference-id: 2.3 + - reference-id: 2.4 - reference-id: SSDF - identifiers: - - PO.4 - - PW.1.2 - - PW.8.1 - - RV.1.2 - - RV.1.3 - - RV.2.1 - - RV 2.2 + entries: + - reference-id: PO.4 + - reference-id: PW.1.2 + - reference-id: PW.8.1 + - reference-id: RV.1.2 + - reference-id: RV.1.3 + - reference-id: RV.2.1 + - reference-id: RV 2.2 - reference-id: CSF - identifiers: - - GV.RM-05 - - GV.RM-06 - - GV.PO-01 - - GV.PO-02 - - ID.RA-01 - - ID.RA-08 - - ID.IM-02 + entries: + - reference-id: GV.RM-05 + - reference-id: GV.RM-06 + - reference-id: GV.PO-01 + - reference-id: GV.PO-02 + - reference-id: ID.RA-01 + - reference-id: ID.RA-08 + - reference-id: ID.IM-02 - reference-id: ISO-18974 - identifiers: - - 4.1.5 - - 4.2.1 - - 4.2.2 - - 4.3.2 + entries: + - reference-id: 4.1.5 + - reference-id: 4.2.1 + - reference-id: 4.2.2 + - reference-id: 4.3.2 - reference-id: OpenCRE - identifiers: - - 155-155 - - 124-564 - - 757-271 - - 464-513 - - 611-158 - - 207-435 - - 088-377 + entries: + - reference-id: 155-155 + - reference-id: 124-564 + - reference-id: 757-271 + - reference-id: 464-513 + - reference-id: 611-158 + - reference-id: 207-435 + - reference-id: 088-377 - reference-id: Scorecard - identifiers: - - Security-Policy - - Vulnerabilities - - SAST + entries: + - reference-id: Security-Policy + - reference-id: Vulnerabilities + - reference-id: SAST - reference-id: PSSCRM - identifiers: - - G5.4 - - P4.1 - - P4.2 - - P4.3 - - P4.4 - - P4.5 + entries: + - reference-id: G5.4 + - reference-id: P4.1 + - reference-id: P4.2 + - reference-id: P4.3 + - reference-id: P4.4 + - reference-id: P4.5 - reference-id: SAMM - identifiers: - - Implementation -Secure Build-Build Process Lvl3 - - Implementation -Software Dependencies Lvl3 - - Verification -Security Testing -Scalable Baseline Lvl1 - - Verification -Security Testing -Scalable Baseline Lvl3 + entries: + - reference-id: Implementation -Secure Build-Build Process Lvl3 + - reference-id: Implementation -Software Dependencies Lvl3 + - reference-id: Verification -Security Testing -Scalable Baseline Lvl1 + - reference-id: Verification -Security Testing -Scalable Baseline Lvl3 - reference-id: PCIDSS - identifiers: - - 6.2.3 - - 6.3.1 - - 6.3.2 - - 6.4.1 - - 6.4.2 - - 6.5.2 + entries: + - reference-id: 6.2.3 + - reference-id: 6.3.1 + - reference-id: 6.3.2 + - reference-id: 6.4.1 + - reference-id: 6.4.2 + - reference-id: 6.5.2 - reference-id: UKSSCOP - identifiers: - - 1.3 - - 1.4 + entries: + - reference-id: 1.3 + - reference-id: 1.4 - reference-id: 800-161 - identifiers: - - CA-7 - - RA-5 - - SA-11 - - SI-2 - - SI-3 + entries: + - reference-id: CA-7 + - reference-id: RA-5 + - reference-id: SA-11 + - reference-id: SI-2 + - reference-id: SI-3 assessment-requirements: - id: OSPS-VM-06.01 text: | diff --git a/cmd/go.mod b/cmd/go.mod index 7b014a3e..0c0b1306 100644 --- a/cmd/go.mod +++ b/cmd/go.mod @@ -7,11 +7,15 @@ toolchain go1.24.1 require ( github.com/defenseunicorns/go-oscal v0.6.3 github.com/goccy/go-yaml v1.18.0 - github.com/revanite-io/sci v0.3.8 + github.com/ossf/gemara v0.7.0 github.com/spf13/cobra v1.9.1 ) require ( + github.com/google/uuid v1.6.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect + github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect github.com/spf13/pflag v1.0.6 // indirect + golang.org/x/text v0.25.0 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/cmd/go.sum b/cmd/go.sum index 8d05305f..853eea6c 100644 --- a/cmd/go.sum +++ b/cmd/go.sum @@ -1,23 +1,32 @@ github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/defenseunicorns/go-oscal v0.6.3 h1:3j5aBobVX+Fy2GEIRCeg9MhsAgCKceOagVEDQPMuzZc= github.com/defenseunicorns/go-oscal v0.6.3/go.mod h1:m55Ny/RTh4xWuxVSOD/poCZs9V9GOjNtjT0NujoxI6I= +github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI= +github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw= github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= -github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/revanite-io/sci v0.3.8 h1:XbbUmpGgWgf0VZouZhoMH0P/wntbJ98AydBgewk5kCw= -github.com/revanite-io/sci v0.3.8/go.mod h1:lEK7w8kfwWUXFKYoJYyqzTT74umE4OkOlRYp88uxHhc= +github.com/ossf/gemara v0.7.0 h1:/ReUIr8FQV+JARnF0kWFOvRfwCOvgotJ/UWRP4nDA3g= +github.com/ossf/gemara v0.7.0/go.mod h1:t7v+tVoy6mXWby7VBurIO/0sT/tIu6mgb2inUhpitTg= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo= github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0= github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o= github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= -github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/stretchr/testify v1.11.0 h1:ib4sjIrwZKxE5u/Japgo/7SJV3PvgjGiRNAvTVGqQl8= +github.com/stretchr/testify v1.11.0/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4= +golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/cmd/pkg/baseline/loader.go b/cmd/pkg/baseline/loader.go index ba474f4c..a146ed08 100644 --- a/cmd/pkg/baseline/loader.go +++ b/cmd/pkg/baseline/loader.go @@ -9,7 +9,7 @@ import ( "path/filepath" "github.com/goccy/go-yaml" - "github.com/revanite-io/sci/layer2" + "github.com/ossf/gemara/layer2" "github.com/ossf/security-baseline/pkg/types" ) diff --git a/cmd/pkg/types/types.go b/cmd/pkg/types/types.go index ac90a0df..7b672fc1 100644 --- a/cmd/pkg/types/types.go +++ b/cmd/pkg/types/types.go @@ -3,7 +3,7 @@ package types -import "github.com/revanite-io/sci/layer2" +import "github.com/ossf/gemara/layer2" var ControlFamilies = []string{ "AC", diff --git a/cmd/template.md b/cmd/template.md index 5b351a0a..40f2009f 100644 --- a/cmd/template.md +++ b/cmd/template.md @@ -115,7 +115,7 @@ For more information on the project and to make contributions, visit the [GitHub #### External Framework Mappings {{ if .GuidelineMappings }} {{ range .GuidelineMappings }} - - **{{ .ReferenceId | addLinks }}**: {{ range $index, $id := .Identifiers }}{{ if $index }}, {{ end }}{{ $id }}{{ end }} + - **{{ .ReferenceId | addLinks }}**: {{ range $index, $id := .Entries }}{{ if $index }}, {{ end }}{{ $id }}{{ end }} {{- end }} {{ end }}