OSPS Baseline release notes
2026-08-28
New controls
- Level 1
- (none)
- Level 2
- (none)
- Level 3
- (none)
Modified controls
- OSPS-LE-03.01 now also accepts a
LICENSES/directory as a license location
Removed controls
(none)
New control mappings
Other changes
- The control mappings are now maintained as machine-readable Gemara mapping documents, published to grc.store with each release alongside the compiled control catalog
- Each version now includes a generated External Framework Crosswalk page (external requirement → OSPS controls), and the External Frameworks table links each framework’s mapping document
- The External Frameworks table now lists only frameworks with published mappings; the OpenChain and OpenCRE entries were renamed to ISO/IEC 18974 and OpenCRE respectively
- Baseline content and tooling migrated to the Gemara v1 schema
2026-02-19
New controls
- Level 1
- Level 2
- Level 3
Modified controls
- OSPS-BR-01.01 updated to remove ambiguity and overlap
- OSPS-BR-03.02 updated to clarify intent
- OSPS-QA-04.01 updated to clarify intent
Removed controls
- OSPS-BR-01.02
New control mappings
- BSI-TR-03185-2
- Additional UKSSCOP
Other changes
- Control titles are more brief to improve clarity
2025-10-10
New controls
- Level 1
- Level 2
- (none)
- Level 3
Modified controls
(none)
Removed controls
(none)
New control mappings
Other changes
- Added definitions for several additional terms in order to improve clarity
2025-02-25
Initial release of the Open Source Project Security Baseline.