OSPS Baseline: Improving Your Project Security the Easy Way
summary
Open Source Project Security (OSPS) Baseline presents a catalog of 40–50 controls organized into three levels (1–3) that map to regulatory frameworks (CRA, NIST SP 800‑161, PCI DSS). It publishes controls as GitHub-stored YAML using the Jamara spec, provides a markdown checklist and integrates with LFX Insights for automated measurement, and accepts pull requests and issues for additions or reclassification; level assignments target projects from docs-only to widely used, and evidence sharing is optional.
AI-written summary · about
chapters (7)
- 0:00OSPS Baseline intro
- 1:05What is OSPS Baseline
- 3:56Baseline for supply chain security
- 11:05Baseline levels and categories
- 16:00Applying baseline to projects
- 19:31Participating in baseline
- 20:15Q&A
related talks
28mSimplifying Global Compliance for CNCF Projects With the OpenSSF OSPS Baseline
14mKeynote: All Your Base Are Belong to Us
46mOSS Management & OSPO Ask Anything
26mLooking at Open Source Security from the Community Angle
48mApplying Cybersecurity Regulations and Industry Standards to Open Source Projects
55mASVS Project
38mFree security resources that your competitors use!
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...