diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml
index 1b65e035..8128fbef 100644
--- a/baseline/OSPS-VM.yaml
+++ b/baseline/OSPS-VM.yaml
@@ -159,18 +159,47 @@ controls:
           that verify compliance with that policy prior to release.
       - id: OSPS-VM-05.03
         text: |
-          All changes to the project's codebase MUST be
-          automatically evaluated against a documented policy for malicious
-          dependencies and known vulnerabilities in dependencies, then blocked
-          in the event of violations, except when declared and suppressed as
-          non-exploitable.
+          Retired in https://github.com/ossf/security-baseline/pull/553
+        applicability:
+          - maturity-3
+        state: Retired
+      - id: OSPS-VM-05.06
+        text: |
+          All changes to the project's codebase MUST be automatically
+          evaluated against a documented policy for malicious dependencies.
         applicability:
           - maturity-3
         recommendation: |
           Create a status check in the project's version control system that
-          runs a Software Composition Analysis tool on all changes
-          to the codebase. Require that the status check passes before changes
-          can be merged.
+          runs a Software Composition Analysis tool on all changes to the
+          codebase to detect malicious dependencies, and configure it to
+          evaluate changes against the project's documented policy.
+      - id: OSPS-VM-05.07
+        text: |
+          All changes to the project's codebase MUST be automatically
+          evaluated against a documented policy for known vulnerabilities in
+          dependencies.
+        applicability:
+          - maturity-3
+        recommendation: |
+          Create a status check in the project's version control system that
+          runs a Software Composition Analysis tool on all changes to the
+          codebase to detect known vulnerabilities in dependencies, and
+          configure it to evaluate changes against the project's documented
+          policy.
+      - id: OSPS-VM-05.08
+        text: |
+          Changes to the codebase MUST be blocked when they violate the
+          documented policy for malicious dependencies or known
+          vulnerabilities.
+        applicability:
+          - maturity-3
+        recommendation: |
+          Configure the project's version control system to require that the
+          Software Composition Analysis status checks pass before changes can
+          be merged. The policy may allow findings to be suppressed (for
+          example, by documenting them in a VEX statement) when they are
+          determined to be non-exploitable.
 
   - id: OSPS-VM-06
     title: |