OWASP / Software-Component-Verification-Standard

Software Component Verification Standard (SCVS)

https://owasp.org/scvs

OWASP/Software-Component-Verification-Standard Issues

Translate standard documentation into Vietnamese language
Updated a year ago1
PDF links
Updated 2 years ago1
Translate to Japanese
Updated 2 years ago2
Create BOM Maturity Model in JSON
Updated 2 years ago
Develop BOM Maturity Model - maturity levels and assignments
Updated 2 years ago
Create BOM Maturity Model Taxonomy
Updated 2 years ago
lvl 2 and lvl 3 is impossible due to requiring both reproducability and non-reproducability of SBOMs
Updated 2 years ago11
Wrong link to OSSC publication
Closed 4 years ago
Request for a bit more explanation
Updated 4 years ago2
Control Mapping
Updated 4 years ago
David A. Wheeler's comments
Updated 4 years ago1
2.4-SCVS-BOM-04 - Should this be applicable to Level 2 as the tools aren't readily available.
Closed 4 years ago2
Add chain-of-custody for source code
Closed 4 years ago
Add component-specific repo requirement
Closed 4 years ago
Investigate additional resources
Closed 4 years ago
Clarify "Devise a path to baseline and mature software supply chain vigilance"
Closed 4 years ago
Using SCVS: Clarify wording regarding levels of SCVS controls
Closed 4 years ago
Inventory: Ambiguity in 3rd party vs open source components
Closed 4 years ago2
Change "impact costs" to "manage costs"
Closed 4 years ago
SCVS-INV-03 may way to specify machine readable (or add additional requirement)
Closed 4 years ago3
SCVS-CAN-14 uses "component type" but the standard does not define the term
Closed 4 years ago3
Preface: Bulleted list
Closed 4 years ago
SCVS-BOM-17 Descriptor
Closed 4 years ago