From cbd2a82b187d547ad657eb3f6f6a1603692d33f0 Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Thu, 3 Sep 2026 16:55:42 +0530 Subject: [PATCH] Split OSPS-VM-05.01 into two requirements Signed-off-by: Satarupa22-SD --- baseline/OSPS-VM.yaml | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index b12969d6..1b65e035 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -121,16 +121,32 @@ controls: assessment-requirements: - id: OSPS-VM-05.01 text: | - The project documentation MUST include a policy that - defines a threshold for remediation of SCA findings related to - vulnerabilities and licenses. + Retired in https://github.com/ossf/security-baseline/pull/554 + applicability: + - maturity-3 + state: Retired + - id: OSPS-VM-05.04 + text: | + The project documentation MUST define a remediation threshold + for SCA findings related to vulnerabilities. applicability: - maturity-3 recommendation: | Document a policy in the project that defines a threshold for - remediation of SCA findings related to vulnerabilities and licenses. - Include the process for identifying, prioritizing, and remediating - these findings. + remediation of SCA findings related to vulnerabilities. Include + the process for identifying, prioritizing, and remediating these + findings. + - id: OSPS-VM-05.05 + text: | + The project documentation MUST define a remediation threshold + for SCA findings related to licenses. + applicability: + - maturity-3 + recommendation: | + Document a policy in the project that defines a threshold for + remediation of SCA findings related to licenses. Include the + process for identifying, prioritizing, and remediating these + findings. - id: OSPS-VM-05.02 text: | The project documentation MUST include a policy to