From d9bea83db44d143bd87573e4e9f16d2ba5e8331b Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Thu, 3 Sep 2026 17:03:22 +0530 Subject: [PATCH 1/3] Split OSPS-VM-01.01 into two requirements Signed-off-by: Satarupa22-SD --- baseline/OSPS-VM.yaml | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index b12969d6..77eed23d 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -20,9 +20,15 @@ controls: assessment-requirements: - id: OSPS-VM-01.01 text: | - The project documentation MUST - include a policy for coordinated vulnerability disclosure (CVD), with a clear - timeframe for response. + Retired in https://github.com/ossf/security-baseline/pull/555 + applicability: + - maturity-2 + - maturity-3 + state: Retired + - id: OSPS-VM-01.02 + text: | + The project documentation MUST include a coordinated + vulnerability disclosure (CVD) policy. applicability: - maturity-2 - maturity-3 @@ -31,6 +37,17 @@ controls: project's policy for coordinated vulnerability disclosure. Include a method for reporting vulnerabilities. Set expectations for how the project will respond and address reported issues. + - id: OSPS-VM-01.03 + text: | + The project's coordinated vulnerability disclosure (CVD) policy + MUST define a timeframe for responding to vulnerability reports. + applicability: + - maturity-2 + - maturity-3 + recommendation: | + Create a SECURITY.md file at the root of the directory, outlining the + project's policy for coordinated vulnerability disclosure. The file + should define a timeframe for responding to vulnerability reports. - id: OSPS-VM-02 title: | From 79f060c6a71d847340106bd194a444ea3b5fbb2f Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Wed, 30 Sep 2026 02:09:19 +0530 Subject: [PATCH 2/3] Update OSPS-VM-01.01 Signed-off-by: Satarupa22-SD --- baseline/OSPS-VM.yaml | 53 +++++++++++++++++++++---------------------- 1 file changed, 26 insertions(+), 27 deletions(-) diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index 77eed23d..62e2b05d 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -20,15 +20,8 @@ controls: assessment-requirements: - id: OSPS-VM-01.01 text: | - Retired in https://github.com/ossf/security-baseline/pull/555 - applicability: - - maturity-2 - - maturity-3 - state: Retired - - id: OSPS-VM-01.02 - text: | - The project documentation MUST include a coordinated - vulnerability disclosure (CVD) policy. + The project documentation MUST include a coordinated vulnerability + disclosure (CVD) policy. applicability: - maturity-2 - maturity-3 @@ -36,18 +29,8 @@ controls: Create a SECURITY.md file at the root of the directory, outlining the project's policy for coordinated vulnerability disclosure. Include a method for reporting vulnerabilities. Set expectations for how the - project will respond and address reported issues. - - id: OSPS-VM-01.03 - text: | - The project's coordinated vulnerability disclosure (CVD) policy - MUST define a timeframe for responding to vulnerability reports. - applicability: - - maturity-2 - - maturity-3 - recommendation: | - Create a SECURITY.md file at the root of the directory, outlining the - project's policy for coordinated vulnerability disclosure. The file - should define a timeframe for responding to vulnerability reports. + project will respond and address reported issues, including a clear + timeframe for responding to vulnerability reports. - id: OSPS-VM-02 title: | @@ -138,16 +121,32 @@ controls: assessment-requirements: - id: OSPS-VM-05.01 text: | - The project documentation MUST include a policy that - defines a threshold for remediation of SCA findings related to - vulnerabilities and licenses. + Retired in https://github.com/ossf/security-baseline/pull/554 + applicability: + - maturity-3 + state: Retired + - id: OSPS-VM-05.04 + text: | + The project documentation MUST define a remediation threshold + for SCA findings related to vulnerabilities. applicability: - maturity-3 recommendation: | Document a policy in the project that defines a threshold for - remediation of SCA findings related to vulnerabilities and licenses. - Include the process for identifying, prioritizing, and remediating - these findings. + remediation of SCA findings related to vulnerabilities. Include + the process for identifying, prioritizing, and remediating these + findings. + - id: OSPS-VM-05.05 + text: | + The project documentation MUST define a remediation threshold + for SCA findings related to licenses. + applicability: + - maturity-3 + recommendation: | + Document a policy in the project that defines a threshold for + remediation of SCA findings related to licenses. Include the + process for identifying, prioritizing, and remediating these + findings. - id: OSPS-VM-05.02 text: | The project documentation MUST include a policy to From cbea060e790bcff3377cd8078db4c359a74695f1 Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Wed, 30 Sep 2026 02:12:38 +0530 Subject: [PATCH 3/3] fix typo Signed-off-by: Satarupa22-SD --- baseline/OSPS-VM.yaml | 28 ++++++---------------------- 1 file changed, 6 insertions(+), 22 deletions(-) diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index 62e2b05d..8aa980af 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -121,32 +121,16 @@ controls: assessment-requirements: - id: OSPS-VM-05.01 text: | - Retired in https://github.com/ossf/security-baseline/pull/554 - applicability: - - maturity-3 - state: Retired - - id: OSPS-VM-05.04 - text: | - The project documentation MUST define a remediation threshold - for SCA findings related to vulnerabilities. - applicability: - - maturity-3 - recommendation: | - Document a policy in the project that defines a threshold for - remediation of SCA findings related to vulnerabilities. Include - the process for identifying, prioritizing, and remediating these - findings. - - id: OSPS-VM-05.05 - text: | - The project documentation MUST define a remediation threshold - for SCA findings related to licenses. + The project documentation MUST include a policy that + defines a threshold for remediation of SCA findings related to + vulnerabilities and licenses. applicability: - maturity-3 recommendation: | Document a policy in the project that defines a threshold for - remediation of SCA findings related to licenses. Include the - process for identifying, prioritizing, and remediating these - findings. + remediation of SCA findings related to vulnerabilities and licenses. + Include the process for identifying, prioritizing, and remediating + these findings. - id: OSPS-VM-05.02 text: | The project documentation MUST include a policy to