Version: 2026.08.28

This crosswalk inverts the OSPS Baseline mapping documents: for each external framework requirement, it lists the Baseline controls that the maintainers believe relate to it. These are reference relationships, not functional connections, and progress on one does not imply progress on the other.

Every section below is generated from a machine-readable Gemara mapping document published to grc.store with each Baseline release.

NIST Special Publication 800-161 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Version r1-upd1 · Framework · Mapping document

Requirement OSPS Baseline Controls
AC-17 OSPS-AC-01
AC-2 OSPS-AC-02, OSPS-GV-01, OSPS-GV-04
AC-20 OSPS-AC-04, OSPS-GV-03, OSPS-GV-04
AC-20(1) OSPS-AC-04
AC-21 OSPS-GV-02
AC-3 OSPS-AC-02, OSPS-AC-03, OSPS-BR-01, OSPS-GV-01, OSPS-GV-03, OSPS-GV-04
AC-3(8) OSPS-AC-04
AC-4 OSPS-AC-04, OSPS-BR-01, OSPS-BR-03, OSPS-BR-05
AC-4(21) OSPS-AC-01, OSPS-AC-02, OSPS-BR-01, OSPS-BR-03, OSPS-GV-04
AC-4(6) OSPS-AC-04
AC-5 OSPS-AC-02, OSPS-AC-03, OSPS-GV-04, OSPS-QA-07
AC-6 OSPS-AC-02, OSPS-AC-04, OSPS-GV-04
AU-10 OSPS-BR-04, OSPS-BR-06
AU-2 OSPS-BR-04
AU-6 OSPS-BR-04, OSPS-GV-02, OSPS-QA-03, OSPS-QA-07
CA-2 OSPS-SA-03
CA-2(3) OSPS-SA-03
CA-7 OSPS-DO-06, OSPS-QA-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
CM-2 OSPS-BR-05, OSPS-DO-01, OSPS-DO-03, OSPS-QA-02, OSPS-SA-01, OSPS-SA-02
CM-3 OSPS-AC-03, OSPS-QA-03, OSPS-VM-04
CM-3(2) OSPS-AC-03
CM-5 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-04
CM-6 OSPS-AC-01, OSPS-BR-04, OSPS-QA-03
CM-7 OSPS-AC-02, OSPS-AC-04, OSPS-BR-01, OSPS-GV-04
CM-7(4) OSPS-BR-05
CM-7(5) OSPS-BR-05, OSPS-DO-06
CM-8 OSPS-DO-06, OSPS-QA-02, OSPS-VM-04
IA-2 OSPS-AC-01, OSPS-GV-01
IA-4 OSPS-BR-02
IA-5 OSPS-AC-01
IR-1 OSPS-DO-03, OSPS-VM-01, OSPS-VM-02
IR-4 OSPS-VM-01, OSPS-VM-02
IR-4(6) OSPS-GV-04
IR-5 OSPS-VM-04
IR-6 OSPS-DO-02, OSPS-VM-01, OSPS-VM-02, OSPS-VM-03
IR-7(1) OSPS-VM-01
IR-8 OSPS-VM-01, OSPS-VM-02
MA-1 OSPS-BR-04
MA-8 OSPS-BR-04
MP-1 OSPS-BR-06, OSPS-DO-03
PL-1 OSPS-DO-04, OSPS-DO-05, OSPS-GV-01, OSPS-GV-02, OSPS-GV-03
PL-2 OSPS-DO-01, OSPS-DO-04, OSPS-DO-05, OSPS-SA-02
PL-4 OSPS-GV-01, OSPS-LE-01, OSPS-LE-02, OSPS-LE-03
PL-8 OSPS-DO-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-04, OSPS-QA-05, OSPS-QA-07, OSPS-SA-01, OSPS-SA-02
PM-30 OSPS-DO-06, OSPS-GV-01, OSPS-GV-04, OSPS-SA-03
RA-3 OSPS-SA-01, OSPS-SA-02, OSPS-SA-03
RA-3(1) OSPS-DO-06, OSPS-QA-02
RA-5 OSPS-BR-05, OSPS-QA-01, OSPS-QA-02, OSPS-VM-05, OSPS-VM-06
SA-11 OSPS-DO-06, OSPS-QA-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-06, OSPS-SA-03, OSPS-VM-05, OSPS-VM-06
SA-15 OSPS-BR-02, OSPS-BR-05, OSPS-BR-06, OSPS-DO-01, OSPS-DO-03, OSPS-QA-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-04, OSPS-QA-05, OSPS-QA-06, OSPS-QA-07, OSPS-SA-01, OSPS-SA-02, OSPS-SA-03
SA-15(3) OSPS-SA-03
SA-15(8) OSPS-SA-03
SI-2 OSPS-VM-01, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
SI-3 OSPS-SA-03, OSPS-VM-05, OSPS-VM-06
SI-4 OSPS-BR-04, OSPS-DO-02, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-04, OSPS-VM-04
SI-5 OSPS-BR-04, OSPS-DO-02, OSPS-DO-05, OSPS-VM-04
SI-7 OSPS-BR-01, OSPS-BR-02, OSPS-BR-06, OSPS-DO-03
SI-7(14) OSPS-BR-06, OSPS-DO-03
SR-3 OSPS-BR-05, OSPS-DO-06, OSPS-QA-02, OSPS-QA-03, OSPS-QA-05, OSPS-QA-06, OSPS-QA-07, OSPS-SA-03
SR-3(3) OSPS-SA-03
SR-4 OSPS-BR-02, OSPS-QA-02
SR-5 OSPS-DO-06
SR-6 OSPS-DO-06, OSPS-SA-03
SR-7 OSPS-DO-06, OSPS-SA-03

OpenSSF Best Practices Badge

Version 2024 · Framework · Mapping document

Requirement OSPS Baseline Controls
A-B-1 OSPS-BR-04, OSPS-VM-05, OSPS-VM-06
A-B-3 OSPS-VM-05, OSPS-VM-06
A-B-8 OSPS-VM-05, OSPS-VM-06
A-S-1 OSPS-BR-04, OSPS-DO-06, OSPS-VM-05, OSPS-VM-06
B-B-1 OSPS-DO-01, OSPS-SA-01
B-B-10 OSPS-SA-02
B-B-11 OSPS-BR-03
B-B-12 OSPS-GV-02
B-B-3 OSPS-DO-02, OSPS-GV-02
B-B-4 OSPS-GV-03
B-B-4+ OSPS-GV-03, OSPS-GV-04
B-B-5 OSPS-GV-04
B-B-6 OSPS-LE-02
B-B-7 OSPS-LE-02
B-B-8 OSPS-LE-03
B-B-9 OSPS-DO-01
B-G-3 OSPS-QA-07
B-S-1 OSPS-LE-01
B-S-3 OSPS-GV-01, OSPS-GV-03, OSPS-GV-04
B-S-4 OSPS-GV-01
B-S-7 OSPS-DO-01, OSPS-SA-01, OSPS-SA-02
B-S-8 OSPS-SA-01, OSPS-SA-03, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06
B-S-9 OSPS-DO-01
CC-B-1 OSPS-QA-01
CC-B-2 OSPS-QA-01
CC-B-3 OSPS-QA-01
CC-B-5 OSPS-BR-02
CC-B-6 OSPS-BR-02
CC-B-7 OSPS-BR-02
CC-B-8 OSPS-BR-04, OSPS-DO-03
CC-B-9 OSPS-BR-04
CC-G-1 OSPS-AC-01
Q-B-10 OSPS-QA-06
Q-B-12 OSPS-VM-05, OSPS-VM-06
Q-B-2 OSPS-BR-05
Q-B-4 OSPS-QA-06
Q-B-7 OSPS-BR-04
Q-B-8 OSPS-QA-06
Q-B-9 OSPS-QA-06
Q-G-2 OSPS-GV-03, OSPS-GV-04
Q-S-2 OSPS-QA-06
Q-S-8 OSPS-QA-02
Q-S-9 OSPS-QA-02, OSPS-VM-05, OSPS-VM-06
R-B-1 OSPS-DO-02, OSPS-GV-03
R-B-1+ OSPS-DO-02
R-B-2 OSPS-DO-02
R-B-3 OSPS-DO-04
R-B-5 OSPS-QA-01
R-B-6 OSPS-VM-01
R-B-7 OSPS-VM-03
R-B-8 OSPS-VM-01
R-S-2 OSPS-DO-02, OSPS-VM-01
S-B-14 OSPS-VM-01, OSPS-VM-05, OSPS-VM-06
S-B-15 OSPS-VM-01, OSPS-VM-05, OSPS-VM-06
S-B-5 OSPS-BR-07
S-G-1 OSPS-SA-03

BSI TR-03185-2 Secure Software Lifecycle for Open Source Software

Version v1.1.0 · Framework · Mapping document

Requirement OSPS Baseline Controls
BR.01 OSPS-DO-01, OSPS-DO-03
BR.02 OSPS-BR-02
BR.03 OSPS-BR-03, OSPS-BR-06, OSPS-DO-03
BR.04 OSPS-BR-04
BR.05 OSPS-QA-05
DE.01 OSPS-DO-04, OSPS-DO-05
GV.01 OSPS-GV-03
GV.02 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03
LE.01 OSPS-LE-02
LE.02 OSPS-LE-03
QA.01 OSPS-DO-06, OSPS-QA-02
QA.02 OSPS-QA-01
QA.03 OSPS-DO-02, OSPS-GV-02
QA.04 OSPS-GV-03, OSPS-QA-03, OSPS-QA-06
QA.05 OSPS-GV-03, OSPS-QA-06, OSPS-VM-06
QA.06 OSPS-AC-03, OSPS-QA-07
VM.01 OSPS-VM-01, OSPS-VM-02, OSPS-VM-03
VM.02 OSPS-VM-04

Cyber Resilience Act

Version 20.11.2024 · Framework · Mapping document

Requirement OSPS Baseline Controls
1.1 OSPS-SA-03
1.2a OSPS-SA-01, OSPS-SA-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
1.2b OSPS-BR-05, OSPS-DO-01, OSPS-LE-01, OSPS-LE-02, OSPS-LE-03, OSPS-QA-01, OSPS-QA-04, OSPS-QA-05, OSPS-SA-01, OSPS-SA-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
1.2c OSPS-DO-02, OSPS-DO-05, OSPS-VM-05, OSPS-VM-06
1.2d OSPS-AC-01, OSPS-AC-04, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-DO-03, OSPS-GV-04
1.2e OSPS-AC-01, OSPS-AC-04, OSPS-BR-03
1.2f OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-LE-01, OSPS-QA-01, OSPS-QA-03, OSPS-QA-04
1.2h OSPS-BR-04, OSPS-BR-05
1.2i OSPS-BR-03
1.2j OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-DO-01, OSPS-QA-01, OSPS-SA-03
1.2k OSPS-BR-03, OSPS-DO-01, OSPS-QA-03, OSPS-SA-03
1.2l OSPS-BR-04, OSPS-DO-02, OSPS-GV-02, OSPS-GV-03, OSPS-GV-04
2.1 OSPS-BR-05, OSPS-DO-02, OSPS-DO-06, OSPS-GV-04, OSPS-QA-02, OSPS-VM-01, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
2.2 OSPS-BR-05, OSPS-DO-02, OSPS-GV-04, OSPS-QA-02, OSPS-SA-03, OSPS-VM-01, OSPS-VM-05, OSPS-VM-06
2.3 OSPS-BR-05, OSPS-GV-02, OSPS-QA-02, OSPS-QA-06, OSPS-VM-01, OSPS-VM-05, OSPS-VM-06
2.4 OSPS-GV-02, OSPS-GV-03, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
2.5 OSPS-BR-04, OSPS-DO-02, OSPS-GV-04, OSPS-VM-02, OSPS-VM-03
2.6 OSPS-DO-02, OSPS-DO-05, OSPS-GV-02, OSPS-GV-04, OSPS-VM-01, OSPS-VM-03, OSPS-VM-04
2.7 OSPS-VM-01
2.8 OSPS-VM-01

NIST Cybersecurity Framework

Version 2.0 · Framework · Mapping document

Requirement OSPS Baseline Controls
DE.AE-07 OSPS-SA-03
GV.OC-03 OSPS-LE-02
GV.OC-04 OSPS-DO-01
GV.OC-05 OSPS-DO-01, OSPS-SA-02
GV.PO-01 OSPS-VM-01, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06
GV.PO-02 OSPS-VM-01, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06
GV.RM-05 OSPS-DO-02, OSPS-VM-05, OSPS-VM-06
GV.RM-06 OSPS-VM-05, OSPS-VM-06
ID.AM-01 OSPS-QA-02, OSPS-SA-02
ID.AM-02 OSPS-QA-01, OSPS-QA-02, OSPS-QA-06, OSPS-SA-01
ID.IM-02 OSPS-QA-03, OSPS-VM-05, OSPS-VM-06
ID.RA-01 OSPS-QA-01, OSPS-SA-03, OSPS-VM-01, OSPS-VM-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
ID.RA-04 OSPS-SA-03
ID.RA-05 OSPS-SA-03
ID.RA-08 OSPS-QA-01, OSPS-VM-01, OSPS-VM-05, OSPS-VM-06
PR.AA-02 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-GV-04
PR.AA-05 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-GV-04
RS.MA-02 OSPS-DO-02

ISO/IEC 18974

Version 1.0 - 2023-12 · Framework · Mapping document

Requirement OSPS Baseline Controls
4.1 OSPS-DO-04
4.1.1 OSPS-DO-05, OSPS-VM-02
4.1.2 OSPS-GV-03, OSPS-GV-04
4.1.3 OSPS-VM-02
4.1.4 OSPS-DO-01, OSPS-QA-01, OSPS-SA-02
4.1.5 OSPS-QA-02, OSPS-QA-03, OSPS-QA-06, OSPS-SA-03, OSPS-VM-01, OSPS-VM-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
4.2.1 OSPS-DO-02, OSPS-VM-01, OSPS-VM-05, OSPS-VM-06
4.2.2 OSPS-VM-02, OSPS-VM-05, OSPS-VM-06
4.3.1 OSPS-DO-04, OSPS-DO-05, OSPS-QA-02
4.3.2 OSPS-VM-01, OSPS-VM-05, OSPS-VM-06

Open Cybersecurity Reference Architecture

Version 2024 · Framework · Mapping document

Requirement OSPS Baseline Controls
013-021 OSPS-GV-01
036-275 OSPS-DO-01, OSPS-SA-01
053-751 OSPS-DO-05, OSPS-DO-06
068-102 OSPS-SA-01, OSPS-SA-02, OSPS-SA-03
072-713 OSPS-SA-02
088-377 OSPS-QA-06, OSPS-VM-05, OSPS-VM-06
123-124 OSPS-AC-04, OSPS-GV-04
124-564 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-QA-01, OSPS-QA-02, OSPS-QA-04, OSPS-QA-05, OSPS-VM-05, OSPS-VM-06
152-725 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-GV-04
154-031 OSPS-SA-03
155-155 OSPS-SA-01, OSPS-SA-02, OSPS-VM-05, OSPS-VM-06
162-655 OSPS-SA-01
171-222 OSPS-DO-03
201-246 OSPS-AC-01
207-435 OSPS-QA-06, OSPS-VM-05, OSPS-VM-06
208-355 OSPS-BR-04
253-452 OSPS-QA-03
263-184 OSPS-AC-04, OSPS-BR-03, OSPS-BR-04, OSPS-QA-03
326-704 OSPS-SA-01
333-858 OSPS-AC-01
347-352 OSPS-AC-01, OSPS-BR-01, OSPS-BR-04, OSPS-BR-05
368-633 OSPS-AC-02
464-513 OSPS-VM-02, OSPS-VM-05, OSPS-VM-06
486-813 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-QA-01, OSPS-QA-02, OSPS-QA-04, OSPS-QA-05
611-158 OSPS-VM-05, OSPS-VM-06
613-286 OSPS-DO-06, OSPS-QA-02
673-475 OSPS-DO-05, OSPS-QA-02
715-334 OSPS-BR-05
732-148 OSPS-BR-04
745-356 OSPS-BR-04
757-271 OSPS-BR-04, OSPS-QA-01, OSPS-VM-05, OSPS-VM-06
802-056 OSPS-AC-02
820-878 OSPS-SA-02
863-521 OSPS-QA-02
887-750 OSPS-VM-01
888-770 OSPS-SA-03

Payment Card Industry Data Security Standard

Version 4.0.1 · Framework · Mapping document

Requirement OSPS Baseline Controls
10.2.2 OSPS-BR-04
11.1.1 OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01
11.1.2 OSPS-GV-01
11.2.1 OSPS-VM-01
11.3.1 OSPS-SA-03, OSPS-VM-04
12.1.1 OSPS-VM-01, OSPS-VM-02
12.1.3 OSPS-GV-01, OSPS-VM-01
12.10.2 OSPS-DO-02, OSPS-VM-02, OSPS-VM-03
12.10.5 OSPS-DO-01
12.3.1 OSPS-SA-01, OSPS-SA-02, OSPS-SA-03
12.5.1 OSPS-QA-02
12.5.2 OSPS-DO-06, OSPS-GV-01, OSPS-GV-02, OSPS-GV-03
12.5.3 OSPS-SA-01
12.8.1 OSPS-SA-02
12.8.5 OSPS-LE-01
2.1.1 OSPS-DO-01, OSPS-DO-04, OSPS-DO-06, OSPS-GV-03, OSPS-GV-04, OSPS-QA-01, OSPS-VM-01
2.1.2 OSPS-GV-01
2.2.1 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-03, OSPS-BR-06, OSPS-DO-01, OSPS-SA-01, OSPS-SA-02
2.2.3 OSPS-SA-01, OSPS-SA-02
2.2.4 OSPS-SA-01, OSPS-SA-02, OSPS-SA-03
2.2.5 OSPS-SA-01, OSPS-SA-02, OSPS-SA-03
2.2.6 OSPS-SA-01, OSPS-SA-02, OSPS-SA-03
2.2.7 OSPS-BR-03, OSPS-BR-06
3.1.1 OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01
3.1.2 OSPS-GV-01
3.2.1 OSPS-DO-04, OSPS-DO-05, OSPS-LE-02, OSPS-LE-03
3.5.1 OSPS-BR-06, OSPS-DO-03
4.1.1 OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01
4.1.2 OSPS-GV-01
4.2.1 OSPS-BR-03, OSPS-BR-06
4.2.2 OSPS-BR-03, OSPS-BR-06
5.1.1 OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01
5.1.2 OSPS-GV-01
6.1.1 OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01
6.1.2 OSPS-GV-01
6.2.1 OSPS-BR-04, OSPS-DO-01, OSPS-DO-03, OSPS-QA-01, OSPS-SA-01, OSPS-SA-02, OSPS-SA-03
6.2.3 OSPS-QA-06, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
6.2.3.1 OSPS-QA-07, OSPS-SA-03
6.3.1 OSPS-QA-03, OSPS-QA-06, OSPS-VM-01, OSPS-VM-03, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
6.3.2 OSPS-DO-02, OSPS-DO-05, OSPS-DO-06, OSPS-QA-02, OSPS-QA-03, OSPS-QA-06, OSPS-SA-03, OSPS-VM-01, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
6.3.3 OSPS-DO-02, OSPS-DO-04, OSPS-VM-02, OSPS-VM-03, OSPS-VM-04
6.4.1 OSPS-BR-01, OSPS-BR-03, OSPS-BR-04, OSPS-BR-06, OSPS-VM-05, OSPS-VM-06
6.4.2 OSPS-QA-04, OSPS-QA-06, OSPS-QA-07, OSPS-SA-03, OSPS-VM-05, OSPS-VM-06
6.4.3 OSPS-BR-02, OSPS-BR-05, OSPS-DO-06, OSPS-QA-02, OSPS-QA-05
6.5.1 OSPS-BR-04, OSPS-DO-02, OSPS-QA-01
6.5.2 OSPS-BR-04, OSPS-DO-02, OSPS-QA-01, OSPS-QA-03, OSPS-VM-06
6.5.4 OSPS-GV-01, OSPS-GV-03, OSPS-GV-04, OSPS-QA-07
7.1.1 OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01
7.1.2 OSPS-GV-01
8.1.1 OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01
8.1.2 OSPS-GV-01
8.2.1 OSPS-AC-01, OSPS-AC-04, OSPS-GV-03, OSPS-GV-04
8.2.2 OSPS-GV-04
8.3.1 OSPS-AC-01
8.3.2 OSPS-BR-03, OSPS-BR-06

Proactive Software Supply Chain Risk Management Framework

Version 1.0 · Framework · Mapping document

Requirement OSPS Baseline Controls
D1.1 OSPS-VM-01, OSPS-VM-04
D1.2 OSPS-VM-01
D1.3 OSPS-VM-01
D1.5 OSPS-VM-01
D2.2 OSPS-BR-01
E1.1 OSPS-BR-03
E1.2 OSPS-AC-01, OSPS-AC-02, OSPS-BR-02
E1.3 OSPS-AC-01
E1.4 OSPS-AC-01
E1.5 OSPS-AC-03
E1.6 OSPS-DO-04, OSPS-DO-05
E2.1 OSPS-BR-02, OSPS-BR-04, OSPS-BR-06, OSPS-QA-02
E2.2 OSPS-BR-03, OSPS-BR-05, OSPS-BR-06, OSPS-QA-01, OSPS-QA-02
E2.3 OSPS-BR-05
E2.4 OSPS-BR-01, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-QA-06
E2.5 OSPS-BR-01, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-QA-06
E2.6 OSPS-BR-02, OSPS-BR-06, OSPS-DO-03
E3.1 OSPS-AC-01, OSPS-AC-03, OSPS-BR-04, OSPS-GV-01, OSPS-GV-04, OSPS-LE-01
E3.3 OSPS-AC-02, OSPS-GV-01, OSPS-GV-04
E3.4 OSPS-SA-01, OSPS-SA-02
E3.5 OSPS-DO-01
E3.6 OSPS-BR-04
E3.7 OSPS-SA-01, OSPS-SA-02
G1.2 OSPS-LE-02, OSPS-LE-03
G1.3 OSPS-DO-03
G1.4 OSPS-BR-02, OSPS-BR-04, OSPS-DO-06, OSPS-QA-02
G1.5 OSPS-QA-02
G2.2 OSPS-QA-03, OSPS-QA-04, OSPS-VM-04
G2.3 OSPS-GV-01
G2.4 OSPS-DO-06, OSPS-GV-03, OSPS-QA-07
G2.5 OSPS-DO-03, OSPS-QA-02
G2.6 OSPS-AC-01
G4.3 OSPS-SA-03
G5.1 OSPS-DO-01, OSPS-SA-01
G5.2 OSPS-SA-03
G5.3 OSPS-QA-03
G5.4 OSPS-QA-03, OSPS-QA-04, OSPS-VM-05, OSPS-VM-06
P1.1 OSPS-SA-01
P1.2 OSPS-BR-06, OSPS-DO-03
P2.1 OSPS-SA-03
P2.2 OSPS-GV-03
P2.3 OSPS-AC-02, OSPS-BR-01
P3.1 OSPS-BR-05, OSPS-DO-03, OSPS-DO-06, OSPS-QA-02
P3.2 OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-06, OSPS-DO-03, OSPS-DO-06, OSPS-QA-02
P3.3 OSPS-AC-01, OSPS-BR-06, OSPS-DO-03, OSPS-QA-07
P3.4 OSPS-DO-06
P3.5 OSPS-AC-03, OSPS-BR-01, OSPS-BR-05, OSPS-QA-01, OSPS-QA-03, OSPS-QA-07
P4.1 OSPS-QA-03, OSPS-QA-06, OSPS-VM-05, OSPS-VM-06
P4.2 OSPS-QA-03, OSPS-QA-06, OSPS-VM-05, OSPS-VM-06
P4.3 OSPS-QA-06, OSPS-VM-05, OSPS-VM-06
P4.4 OSPS-QA-06, OSPS-VM-05, OSPS-VM-06
P4.5 OSPS-VM-05, OSPS-VM-06
P5.1 OSPS-QA-02
P5.2 OSPS-QA-02

OWASP Software Assurance Maturity Model

Version 2.0 · Framework · Mapping document

Requirement OSPS Baseline Controls
Design - Security Requirements - Supplier Security Lvl2 OSPS-DO-06
Design - Threat Assessment - Application Risk Profile Lvl1 OSPS-SA-03
Design - Threat Assessment - Threat Modeling Lvl1 OSPS-SA-03
Governance - Policy & Compliance - Policy & Standards Lvl1 OSPS-VM-01
Governance - Policy & Compliance - Policy & Standards Lvl2 OSPS-VM-02
Governance - Strategy & Metrics - Create and Promote Lvl1 OSPS-SA-03
Governance - Strategy & Metrics - Create and Promote Lvl2 OSPS-VM-01
Implementation - Defect Management - Defect Tracking Lvl1 OSPS-DO-02, OSPS-VM-01
Implementation - Defect Management - Defect Tracking Lvl2 OSPS-DO-02, OSPS-VM-01
Implementation - Defect Management - Defect Tracking Lvl3 OSPS-VM-01
Implementation - Secure Build - Build Process Lvl1 OSPS-QA-01
Implementation - Secure Build - Build Process Lvl2 OSPS-BR-05
Implementation - Secure Build - Build Process Lvl3 OSPS-QA-03, OSPS-VM-05, OSPS-VM-06
Implementation - Secure Build - Software Dependencies Lvl1 OSPS-QA-02
Implementation - Secure Build - Software Dependencies Lvl3 OSPS-QA-03, OSPS-VM-05, OSPS-VM-06
Implementation - Secure Deployment - Deployment Process Lvl3 OSPS-BR-06
Operations - Environment Management - Configuration Hardening Lvl1 OSPS-AC-01, OSPS-AC-04
Operations - Incident Management - Incident Response Lvl1 OSPS-VM-01
Operations - Incident Management - Incident Response Lvl2 OSPS-VM-01
Operations - Incident Management - Incident Response Lvl3 OSPS-VM-01, OSPS-VM-03
Operations - Operational Management - Data Protection Lvl2 OSPS-SA-01
Operations - Operational Management - System Decommissioning / Legacy Management Lvl1 OSPS-DO-04, OSPS-DO-05
Operations - Operational Management - System Decommissioning / Legacy Management Lvl2 OSPS-DO-05
Verification - Architecture Assessment - Architecture Mitigation Lvl2 OSPS-SA-03
Verification - Requirements-driven Testing - Control Verification Lvl1 OSPS-QA-03, OSPS-QA-06
Verification - Requirements-driven Testing - Control Verification Lvl2 OSPS-QA-03, OSPS-QA-06
Verification - Requirements-driven Testing - Control Verification Lvl3 OSPS-QA-03, OSPS-QA-06
Verification - Security Testing - Scalable Baseline Lvl1 OSPS-VM-05, OSPS-VM-06
Verification - Security Testing - Scalable Baseline Lvl3 OSPS-QA-06, OSPS-VM-05, OSPS-VM-06

OpenSSF Scorecard

Version 5.0 · Framework · Mapping document

Requirement OSPS Baseline Controls
Binary-Artifacts OSPS-QA-05
Branch-Protection OSPS-AC-03
CI-Tests OSPS-QA-06
Code-Review OSPS-QA-07
Dangerous-Workflow OSPS-BR-01
License OSPS-LE-02, OSPS-LE-03
Pinned-Dependencies OSPS-DO-06
SAST OSPS-VM-06
Security-Policy OSPS-VM-01, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06
Signed-Releases OSPS-BR-06
Vulnerabilities OSPS-VM-05, OSPS-VM-06

Supply-chain Levels for Software Artifacts

Version 1.0 · Framework · Mapping document

Requirement OSPS Baseline Controls
Build platform - Isolation strength - Isolated OSPS-AC-04, OSPS-BR-04, OSPS-BR-05, OSPS-QA-01, OSPS-QA-04
Build platform - Provenance generation - Authentic OSPS-BR-02
Build platform - Provenance generation - Exists OSPS-BR-02
Choose an appropriate build platform OSPS-AC-04, OSPS-BR-01, OSPS-BR-03, OSPS-BR-04
Distribute provenance OSPS-BR-06
Follow a consistent build process OSPS-BR-02, OSPS-BR-04

Secure Software Development Framework

Version 1.1 · Framework · Mapping document

Requirement OSPS Baseline Controls
PO.1 OSPS-SA-01
PO.1.1 OSPS-BR-07
PO.2 OSPS-AC-02, OSPS-AC-04, OSPS-GV-04, OSPS-SA-01
PO.3.1 OSPS-BR-07
PO.3.2 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-05, OSPS-GV-04, OSPS-LE-01, OSPS-LE-02, OSPS-LE-03, OSPS-QA-04, OSPS-SA-01
PO.3.3 OSPS-QA-02
PO.4 OSPS-VM-05, OSPS-VM-06
PO.4.1 OSPS-QA-03, OSPS-QA-04, OSPS-VM-04
PO.4.2 OSPS-BR-07, OSPS-DO-03, OSPS-DO-04
PO.5.1 OSPS-BR-07, OSPS-SA-03
PO.5.2 OSPS-BR-01, OSPS-BR-03, OSPS-BR-06
PS.1 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-LE-01, OSPS-QA-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-04, OSPS-QA-05
PS.2 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-BR-06, OSPS-DO-03, OSPS-QA-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-04, OSPS-QA-05
PS.2.1 OSPS-BR-06, OSPS-DO-03
PS.3 OSPS-BR-02, OSPS-BR-04, OSPS-GV-02, OSPS-QA-01
PS.3.1 OSPS-DO-03, OSPS-DO-04
PS.3.2 OSPS-QA-02
PW.1.1 OSPS-SA-03
PW.1.2 OSPS-BR-04, OSPS-BR-07, OSPS-DO-01, OSPS-DO-02, OSPS-GV-02, OSPS-GV-03, OSPS-LE-01, OSPS-QA-01, OSPS-SA-02, OSPS-VM-05, OSPS-VM-06
PW.1.3 OSPS-BR-07
PW.2.1 OSPS-LE-01, OSPS-QA-01
PW.4 OSPS-QA-02
PW.5.1 OSPS-BR-07
PW.6.2 OSPS-BR-06
PW.8.1 OSPS-VM-05, OSPS-VM-06
PW.8.2 OSPS-QA-06
RV.1.1 OSPS-DO-02
RV.1.2 OSPS-DO-02, OSPS-QA-03, OSPS-QA-04, OSPS-VM-05, OSPS-VM-06
RV.1.3 OSPS-DO-03, OSPS-DO-04, OSPS-VM-01, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06
RV.2.1 OSPS-DO-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06
RV.2.2 OSPS-VM-04, OSPS-VM-05, OSPS-VM-06

United Kingdom National Cyber Security Centre Software Security Code of Practice

Version 2025-05-07 · Framework · Mapping document

Requirement OSPS Baseline Controls
1.1 OSPS-DO-02
1.2 OSPS-DO-06, OSPS-VM-05
1.3 OSPS-DO-02, OSPS-VM-06
1.4 OSPS-VM-06
3.1 OSPS-DO-03
3.2 OSPS-VM-02, OSPS-VM-03
3.3 OSPS-DO-06, OSPS-VM-05
3.4 OSPS-VM-04
3.5 OSPS-DO-05, OSPS-VM-04
4.1 OSPS-DO-01, OSPS-DO-04, OSPS-DO-05
4.2 OSPS-DO-04
4.3 OSPS-VM-04
Claim 1.1.4 OSPS-AC-03, OSPS-BR-02, OSPS-BR-04
Claim 1.1.5 OSPS-SA-01, OSPS-SA-02
Claim 1.2.1 OSPS-BR-05, OSPS-DO-06, OSPS-QA-02
Claim 1.2.2 OSPS-BR-06, OSPS-DO-06, OSPS-QA-02
Claim 1.2.5 OSPS-BR-05
Claim 1.3.2 OSPS-QA-03
Claim 1.3.3 OSPS-QA-03
Claim 1.4.1 OSPS-SA-03
Claim 1.4.2 OSPS-AC-01
Claim 1.4.3 OSPS-BR-07
Claim 1.4.5 OSPS-BR-07
Claim 2.1.1 OSPS-AC-04, OSPS-GV-01, OSPS-GV-03
Claim 2.1.2 OSPS-BR-01
Claim 2.1.3 OSPS-AC-04
Claim 2.1.5 OSPS-AC-01
Claim 2.2.2 OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01
Claim 2.2.3 OSPS-BR-04, OSPS-QA-01
Claim 3.1.1 OSPS-BR-02, OSPS-BR-04, OSPS-BR-06, OSPS-QA-02
Claim 3.1.2 OSPS-BR-03
Claim 3.4.1 OSPS-VM-01
Claim 3.4.2 OSPS-BR-02
Claim 3.5.1 OSPS-VM-01
Claim 4.1.1 OSPS-DO-04, OSPS-DO-05
Claim 4.1.2 OSPS-DO-04, OSPS-VM-01
Claim 4.2.1 OSPS-DO-04, OSPS-DO-05