Skip to content

Split OSPS-VM-05.01 into two requirements #554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Satarupa22-SD wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Split OSPS-VM-05.01 into two requirements #554

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 22 additions & 6 deletions baseline/OSPS-VM.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,16 +121,32 @@ controls:
assessment-requirements:
- id: OSPS-VM-05.01
text: |
The project documentation MUST include a policy that
defines a threshold for remediation of SCA findings related to
vulnerabilities and licenses.
Retired in https://github.com/ossf/security-baseline/pull/554
applicability:
- maturity-3
state: Retired
- id: OSPS-VM-05.04
text: |
The project documentation MUST define a remediation threshold
for SCA findings related to vulnerabilities.
applicability:
- maturity-3
recommendation: |
Document a policy in the project that defines a threshold for
remediation of SCA findings related to vulnerabilities and licenses.
Include the process for identifying, prioritizing, and remediating
these findings.
remediation of SCA findings related to vulnerabilities. Include
the process for identifying, prioritizing, and remediating these
findings.
- id: OSPS-VM-05.05
text: |
The project documentation MUST define a remediation threshold
for SCA findings related to licenses.
applicability:
- maturity-3
recommendation: |
Document a policy in the project that defines a threshold for
remediation of SCA findings related to licenses. Include the
process for identifying, prioritizing, and remediating these
findings.
- id: OSPS-VM-05.02
text: |
The project documentation MUST include a policy to
Expand Down
Loading