Skip to content

Commit 55a6737

Browse files
masc2023masc2023
authored
Merge pull request #92 from eclipse-score/masc2023_add_initial_security_management
initial security management
2 parents 604431e + 6358ffb commit 55a6737

18 files changed

+1338
-9
lines changed

‎process/_assets/score_process_area_overview.drawio.svg‎

Lines changed: 1 addition & 1 deletion
Loading

‎process/process_areas/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ Process Areas
3131
requirements_engineering/index.rst
3232
safety_analysis/index.rst
3333
safety_management/index.rst
34+
security_management/index.rst
3435
tool_management/index.rst
3536
verification/index.rst
3637
process_management/index.rst

‎process/process_areas/security_management/guidance/index.rst‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
..
2+
# *******************************************************************************
3+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
4+
#
5+
# See the NOTICE file(s) distributed with this work for additional
6+
# information regarding copyright ownership.
7+
#
8+
# This program and the accompanying materials are made available under the
9+
# terms of the Apache License Version 2.0 which is available at
10+
# https://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# SPDX-License-Identifier: Apache-2.0
13+
# *******************************************************************************
14+
15+
Guidance
16+
########
17+
18+
.. toctree::
19+
:maxdepth: 1
20+
21+
security_management_guideline
22+
security_management_feature_security_wp_template
23+
security_management_module_security_plan_template
24+
security_management_security_manual_template
25+
security_management_checklist_security_package
26+
security_management_checklist_security_plan
27+
security_management_process_reqs

‎process/process_areas/security_management/guidance/security_management_checklist_security_package.rst‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
..
2+
# *******************************************************************************
3+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
4+
#
5+
# See the NOTICE file(s) distributed with this work for additional
6+
# information regarding copyright ownership.
7+
#
8+
# This program and the accompanying materials are made available under the
9+
# terms of the Apache License Version 2.0 which is available at
10+
# https://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# SPDX-License-Identifier: Apache-2.0
13+
# *******************************************************************************
14+
15+
Security Package Formal Review Checklist
16+
========================================
17+
18+
.. gd_chklst:: Security Package Formal Review Checklist
19+
:id: gd_chklst__security_package
20+
:status: valid
21+
:complies: std_req__isosae21434__prj_management_6471, std_req__isosae21434__prj_management_6491, std_req__isosae21434__prj_management_6492
22+
23+
**1. Purpose**
24+
25+
The purpose of this review checklist is to report status of the formal review for the security package.
26+
27+
**2. Checklist**
28+
29+
.. list-table:: Security Package Checklist
30+
:header-rows: 1
31+
32+
* - Id
33+
- Security package activity
34+
- Compliant to ISO SAE 21434?
35+
- Comment
36+
37+
* - 1
38+
- Is a security package provided which matches the security plan (i.e. all planned work products referenced)?
39+
- [YES | NO ]
40+
- <Rationale for result>
41+
42+
* - 2
43+
- Is the argument how security is achieved, provided in the security package, plausible and sufficient?
44+
- NO
45+
- The argument is intentionally not provided by the Project.
46+
47+
* - 3
48+
- Are the referenced work products available?
49+
- [YES | NO ]
50+
- <Rationale for result>
51+
52+
* - 4
53+
- Are the referenced work products in released state, including the process security audit?
54+
- NO
55+
- Security audit is currently not planned, tailored out.
56+
57+
* - 5
58+
- If security related deviations from the process or security concept are documented, are these argued understandably?
59+
- [YES | NO ]
60+
- <Rationale for result>
61+
62+
* - 6
63+
- Are the requirements for post-development available?
64+
- [YES | NO ]
65+
- <Rationale for result>

‎process/process_areas/security_management/guidance/security_management_checklist_security_plan.rst‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
..
2+
# *******************************************************************************
3+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
4+
#
5+
# See the NOTICE file(s) distributed with this work for additional
6+
# information regarding copyright ownership.
7+
#
8+
# This program and the accompanying materials are made available under the
9+
# terms of the Apache License Version 2.0 which is available at
10+
# https://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# SPDX-License-Identifier: Apache-2.0
13+
# *******************************************************************************
14+
15+
Security Plan Review Checklist
16+
==============================
17+
18+
.. gd_chklst:: Security Plan Review Checklist
19+
:id: gd_chklst__security_plan
20+
:status: valid
21+
:complies: std_req__isosae21434__prj_management_6411, std_req__isosae21434__prj_management_6421, std_req__isosae21434__prj_management_6422, std_req__isosae21434__prj_management_6423, std_req__isosae21434__prj_management_6424, std_req__isosae21434__prj_management_6425, std_req__isosae21434__prj_management_6426, std_req__isosae21434__prj_management_6427, std_req__isosae21434__prj_management_6428, std_req__isosae21434__prj_management_6429, std_req__isosae21434__prj_management_64210, std_req__isosae21434__prj_management_64211, std_req__isosae21434__prj_management_6431, std_req__isosae21434__prj_management_6432, std_req__isosae21434__prj_management_6441, std_req__isosae21434__prj_management_6442, std_req__isosae21434__prj_management_6443, std_req__isosae21434__prj_management_6451, std_req__isosae21434__prj_management_6452, std_req__isosae21434__prj_management_6453, std_req__isosae21434__prj_management_6461, std_req__isosae21434__prj_management_6462
22+
23+
**1. Purpose**
24+
25+
The purpose of this security plan review checklist is to report status of the review for the security plan.
26+
27+
**2. Checklist**
28+
29+
.. list-table:: Security Plan Checklist
30+
:header-rows: 1
31+
32+
* - Id
33+
- Security plan activity
34+
- Compliant to ISO SAE 21434?
35+
- Comment
36+
37+
* - 1
38+
- Is the rationale for the security work products tailoring included?
39+
- [YES | NO ]
40+
- <Rationale for result>
41+
42+
* - 2
43+
- Is impact analysis planned in case of re-use of SW (needed for every release following the first formal release)?
44+
- [YES | NO ]
45+
- <Rationale for result>
46+
47+
* - 3
48+
- Does the security plan define all needed activities for security management (incl. Review and Security Audit)?
49+
- [YES | NO ]
50+
- <Rationale for result>
51+
52+
* - 4
53+
- Does the security plan define all needed activities for SW development, integration and verification?
54+
- [YES | NO ]
55+
- <Rationale for result>
56+
57+
* - 5
58+
- Does the security plan define all needed activities for security analysis?
59+
- [YES | NO ]
60+
- <Rationale for result>
61+
62+
* - 6
63+
- Does the security plan define all needed activities for supporting processes (incl. tool mgt)?
64+
- [YES | NO ]
65+
- <Rationale for result>
66+
67+
* - 7
68+
- Does the security plan document a responsible for all activities?
69+
- [YES | NO ]
70+
- <Rationale for result>
71+
72+
* - 8
73+
- If Off-the-shelf (e.g. existing OSS) software components is used, is it planned to be analysed?
74+
- [YES | NO ]
75+
- <Rationale for result>
76+
77+
* - 9
78+
- Is a security manager and a technical/module lead appointed for the project?
79+
- [YES | NO ]
80+
- <Rationale for result>
81+
82+
* - 10
83+
- Is security plan sufficiently linked to the project plan?
84+
- [YES | NO ]
85+
- <Rationale for result>
86+
87+
* - 11
88+
- Is security plan updated iteratively to show the progress?
89+
- [YES | NO ]
90+
- <Rationale for result>
91+
92+
* - 12
93+
- If Out-of-context software components is used, are the assumptions documented?
94+
- [YES | NO ]
95+
- <Rationale for result>
96+
97+
* - 13
98+
- Does the security plan define all needed activities for SBOM generation?
99+
- [YES | NO ]
100+
- <Rationale for result>
101+
102+
* - 14
103+
- Does the security plan define regular vulnerability scans for the generated SBOM?
104+
- [YES | NO ]
105+
- <Rationale for result>
106+
107+
.. note::
108+
Off-the-shelf means existing software which may used w/o modification, e.g. existing OSS

‎process/process_areas/security_management/guidance/security_management_feature_security_wp_template.rst‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
..
2+
# *******************************************************************************
3+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
4+
#
5+
# See the NOTICE file(s) distributed with this work for additional
6+
# information regarding copyright ownership.
7+
#
8+
# This program and the accompanying materials are made available under the
9+
# terms of the Apache License Version 2.0 which is available at
10+
# https://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# SPDX-License-Identifier: Apache-2.0
13+
# *******************************************************************************
14+
15+
Feature Security Work Products Template
16+
=======================================
17+
18+
.. gd_temp:: Feature Security Work Products Template
19+
:id: gd_temp__feature_security_wp
20+
:status: valid
21+
:complies:
22+
23+
For the content see here: (tbd https://github.com/eclipse-score/process_description/issues/109)
24+
ref:`feature_security_wp_template`

0 commit comments

Comments
 (0)