Skip to content

Commit fec12ac

Browse files
shanecoughlanshanecoughlan
committed
Create Security-Assurance-1-1-Questionnaire-Version-1.md
Added the first version of the Security Assurance Specification 1.1 self-certification questionnaire.
1 parent 1b787df commit fec12ac

File tree

1 file changed

+185
-0
lines changed

1 file changed

+185
-0
lines changed

‎Self-Certification/Questionnaire/Security-Assurance-1.1/en/Security-Assurance-1-1-Questionnaire-Version-1.md

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
![](./media/image1.png "OpenChain logo")
2+
3+
# OpenChain Security Assurance Specification 1.1 Self-Certification Questionnaire
4+
## The Simple Way To Check Conformance
5+
6+
Revision 1\
7+
2022-10-15
8+
9+
# Introduction
10+
11+
The OpenChain Security Assurance Specification is intended to identify and describe the key requirements of a quality Security Assurance Program in the context of using Open Source Software. It focuses on a narrow subset of primary concern: checking Open Source Software against publicly known security vulnerabilities like CVEs, GitHub/GitLab vulnerability reports, and so on.
12+
13+
You can adopt the OpenChain Security Assurance Specification by self-certification in your own time or working with a service provider for independent assessment or third-party certification. Our recommended path is self-certification and we provide this document to support this with a series of "yes" or "no" statements. If you can answer "yes" to everything, you are self-certified. If you answer "no" to some items, you know where to invest further time to build a quality program.
14+
15+
We have a lot of resources to support you if you need assistance. You can join our mailing lists, our webinars, our group calls and our regional work groups to discuss challenges with your peers and in your native language. You can get started here:
16+
17+
[[https://www.openchainproject.org/community]{.underline}](https://www.openchainproject.org/community)
18+
19+
Finally, if you want direct support from the project you can email
20+
[[[email protected]]{.underline}](mailto:[email protected])
21+
with questions. We provide support for free. The OpenChain Project is funded by our Platinum Members and is designed to help support the global supply chain transition to more effective and efficient open source license compliance.
22+
23+
# The Self-Certification Questionnaire
24+
25+
## Section 3.1.1
26+
27+
Do you have a policy governing the open source security assurance of Supplied Software?
28+
- [ ] Yes
29+
- [ ] No
30+
31+
Do you have a documented procedure to communicate the existence of the open source policy to all Software Staff?
32+
- [ ] Yes
33+
- [ ] No
34+
35+
## Section 3.1.2
36+
37+
Have you identified the roles and responsibilities that affect the performance and effectiveness of the Program?
38+
- [ ] Yes
39+
- [ ] No
40+
41+
Have you identified and documented the competencies required for each role?
42+
- [ ] Yes
43+
- [ ] No
44+
45+
Have you identified and documented a list of Program Participants and how they fill their respective roles?
46+
- [ ] Yes
47+
- [ ] No
48+
49+
Have you documented the assessed competence for each Program Participant?
50+
- [ ] Yes
51+
- [ ] No
52+
53+
Do you have a way to document periodic reviews and changes made to the processes?
54+
- [ ] Yes
55+
- [ ] No
56+
57+
Do you have a way to vertify that the processes align with current company best practices and staff assignments?
58+
- [ ] Yes
59+
- [ ] No
60+
61+
## Section 3.1.3
62+
63+
- Have you documented the open source security assurance policy and made sure Program Participants are aware of where to find it?
64+
- [ ] Yes
65+
- [ ] No
66+
67+
- Have you documented relevant open source objectives and made sure Program Participants are aware of where to find them?
68+
- [ ] Yes
69+
- [ ] No
70+
71+
- Have you documented contributions expected to ensure the effectiveness of the Program and made sure Program Participants are aware of this?
72+
- [ ] Yes
73+
- [ ] No
74+
75+
- Have you documented the implications of failing to follow the Program requirements and made sure Program Participants are aware of where of this?
76+
- [ ] Yes
77+
- [ ] No
78+
79+
## Section 3.1.4
80+
81+
Do you have a written statement clearly defining the scope and limits of the Program?
82+
- [ ] Yes
83+
- [ ] No
84+
85+
Do you have a set of metrics to measure Program performance?
86+
- [ ] Yes
87+
- [ ] No
88+
89+
Do you have Documented Evidence from each review, update, or audit to demonstrate continuous improvement?
90+
- [ ] Yes
91+
- [ ] No
92+
93+
## Section 3.1.5
94+
95+
Do you have a method to identify structural and technical threats to the Supplied Software?
96+
- [ ] Yes
97+
- [ ] No
98+
99+
Do you have a method for detecting existence of Known Vulnerabilities in Supplied Software?
100+
- [ ] Yes
101+
- [ ] No
102+
103+
Do you have a method for following up on identified Known Vulnerabilities?
104+
- [ ] Yes
105+
- [ ] No
106+
107+
Do you have a method to communicate identified Known Vulnerabilities to customer base when warranted?
108+
- [ ] Yes
109+
- [ ] No
110+
111+
Do you have a method for analyzing Supplied Software for newly published Known Vulnerabilities post release of the Supplied Software?
112+
- [ ] Yes
113+
- [ ] No
114+
115+
Do you have a method for continuous and repeated Security Testing is applied for all Supplied Software before release?
116+
- [ ] Yes
117+
- [ ] No
118+
119+
Do you have a method to verify that identified risks will have been addressed before release of Supplied Software?
120+
- [ ] Yes
121+
- [ ] No
122+
123+
Do you have a method to export information about identified risks to third parties as appropriate?
124+
- [ ] Yes
125+
- [ ] No
126+
127+
## Section 3.2.1
128+
129+
Do you have a method to allow third parties to make Known Vulnerability or Newly Discovered Vulnerability enquires (e.g., via an email address or web portal that is monitored by Program Participants)?
130+
- [ ] Yes
131+
- [ ] No
132+
133+
Do you have an internal documented procedure for responding to third party Known Vulnerability or Newly Discovered Vulnerability inquiries?
134+
- [ ] Yes
135+
- [ ] No
136+
137+
## Section 3.2.2
138+
139+
Have you documented the people, group or functions related to the Program?
140+
- [ ] Yes
141+
- [ ] No
142+
143+
Have you ensured the identified Program roles have been properly staffed and adequate funding has been provided?
144+
- [ ] Yes
145+
- [ ] No
146+
147+
Have you ensured expertise available is to address identified Known Vulnerabilities?
148+
- [ ] Yes
149+
- [ ] No
150+
151+
Do you have a documented procedure that assigns internal responsibilities for Security Assurance?
152+
- [ ] Yes
153+
- [ ] No
154+
155+
## Section 3.3.1
156+
157+
Do you have a documented procedure ensuring all Open Source Software used in the Supplied Software is continuously recorded across the lifecycle of the Supplied Software? This includes an archive of all Open Source Software used in the Supplied Software.
158+
- [ ] Yes
159+
- [ ] No
160+
161+
Do you have open source component records for the Supplied Software which demonstrate the documented procedure was properly followed?
162+
- [ ] Yes
163+
- [ ] No
164+
165+
## Section 3.3.2
166+
167+
Do you have a documented procedure for handling detection and resolution of Known Vulnerabilities for the Open Source Software components of the Supplied Software?s
168+
- [ ] Yes
169+
- [ ] No
170+
171+
Do you have open source component records for the Supplied Software which track identified Known Vulnerabilities and action(s) taken (including even if no action was required)?
172+
- [ ] Yes
173+
- [ ] No
174+
175+
## Section 3.4.1
176+
177+
Do you have documentation confirming that the Program meets all the requirements of this specification?
178+
- [ ] Yes
179+
- [ ] No
180+
181+
## Section 3.4.2
182+
183+
Do you have documentation confirming that Program conformance was reviewed within the last 18 months?
184+
- [ ] Yes
185+
- [ ] No

0 commit comments

Comments
 (0)