# External Framework Crosswalk

This crosswalk inverts the OSPS Baseline mapping documents: for each external
framework requirement, it lists the Baseline controls that the maintainers
believe relate to it. These are reference relationships, not functional
connections, and progress on one does not imply progress on the other.

Every section below is generated from a machine-readable
[Gemara](https://gemara.openssf.org) mapping document published to
[grc.store](https://grc.store/openssf) with each Baseline release.

* Contents
{:toc}

## NIST Special Publication 800-161 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Version r1-upd1 · [Framework](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf) · [Mapping document](https://grc.store/openssf/osps-baseline-to-800-161)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| AC-17 | OSPS-AC-01 |
| AC-2 | OSPS-AC-02, OSPS-GV-01, OSPS-GV-04 |
| AC-20 | OSPS-AC-04, OSPS-GV-03, OSPS-GV-04 |
| AC-20(1) | OSPS-AC-04 |
| AC-21 | OSPS-GV-02 |
| AC-3 | OSPS-AC-02, OSPS-AC-03, OSPS-BR-01, OSPS-GV-01, OSPS-GV-03, OSPS-GV-04 |
| AC-3(8) | OSPS-AC-04 |
| AC-4 | OSPS-AC-04, OSPS-BR-01, OSPS-BR-03, OSPS-BR-05 |
| AC-4(21) | OSPS-AC-01, OSPS-AC-02, OSPS-BR-01, OSPS-BR-03, OSPS-GV-04 |
| AC-4(6) | OSPS-AC-04 |
| AC-5 | OSPS-AC-02, OSPS-AC-03, OSPS-GV-04, OSPS-QA-07 |
| AC-6 | OSPS-AC-02, OSPS-AC-04, OSPS-GV-04 |
| AU-10 | OSPS-BR-04, OSPS-BR-06 |
| AU-2 | OSPS-BR-04 |
| AU-6 | OSPS-BR-04, OSPS-GV-02, OSPS-QA-03, OSPS-QA-07 |
| CA-2 | OSPS-SA-03 |
| CA-2(3) | OSPS-SA-03 |
| CA-7 | OSPS-DO-06, OSPS-QA-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| CM-2 | OSPS-BR-05, OSPS-DO-01, OSPS-DO-03, OSPS-QA-02, OSPS-SA-01, OSPS-SA-02 |
| CM-3 | OSPS-AC-03, OSPS-QA-03, OSPS-VM-04 |
| CM-3(2) | OSPS-AC-03 |
| CM-5 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-04 |
| CM-6 | OSPS-AC-01, OSPS-BR-04, OSPS-QA-03 |
| CM-7 | OSPS-AC-02, OSPS-AC-04, OSPS-BR-01, OSPS-GV-04 |
| CM-7(4) | OSPS-BR-05 |
| CM-7(5) | OSPS-BR-05, OSPS-DO-06 |
| CM-8 | OSPS-DO-06, OSPS-QA-02, OSPS-VM-04 |
| IA-2 | OSPS-AC-01, OSPS-GV-01 |
| IA-4 | OSPS-BR-02 |
| IA-5 | OSPS-AC-01 |
| IR-1 | OSPS-DO-03, OSPS-VM-01, OSPS-VM-02 |
| IR-4 | OSPS-VM-01, OSPS-VM-02 |
| IR-4(6) | OSPS-GV-04 |
| IR-5 | OSPS-VM-04 |
| IR-6 | OSPS-DO-02, OSPS-VM-01, OSPS-VM-02, OSPS-VM-03 |
| IR-7(1) | OSPS-VM-01 |
| IR-8 | OSPS-VM-01, OSPS-VM-02 |
| MA-1 | OSPS-BR-04 |
| MA-8 | OSPS-BR-04 |
| MP-1 | OSPS-BR-06, OSPS-DO-03 |
| PL-1 | OSPS-DO-04, OSPS-DO-05, OSPS-GV-01, OSPS-GV-02, OSPS-GV-03 |
| PL-2 | OSPS-DO-01, OSPS-DO-04, OSPS-DO-05, OSPS-SA-02 |
| PL-4 | OSPS-GV-01, OSPS-LE-01, OSPS-LE-02, OSPS-LE-03 |
| PL-8 | OSPS-DO-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-04, OSPS-QA-05, OSPS-QA-07, OSPS-SA-01, OSPS-SA-02 |
| PM-30 | OSPS-DO-06, OSPS-GV-01, OSPS-GV-04, OSPS-SA-03 |
| RA-3 | OSPS-SA-01, OSPS-SA-02, OSPS-SA-03 |
| RA-3(1) | OSPS-DO-06, OSPS-QA-02 |
| RA-5 | OSPS-BR-05, OSPS-QA-01, OSPS-QA-02, OSPS-VM-05, OSPS-VM-06 |
| SA-11 | OSPS-DO-06, OSPS-QA-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-06, OSPS-SA-03, OSPS-VM-05, OSPS-VM-06 |
| SA-15 | OSPS-BR-02, OSPS-BR-05, OSPS-BR-06, OSPS-DO-01, OSPS-DO-03, OSPS-QA-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-04, OSPS-QA-05, OSPS-QA-06, OSPS-QA-07, OSPS-SA-01, OSPS-SA-02, OSPS-SA-03 |
| SA-15(3) | OSPS-SA-03 |
| SA-15(8) | OSPS-SA-03 |
| SI-2 | OSPS-VM-01, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| SI-3 | OSPS-SA-03, OSPS-VM-05, OSPS-VM-06 |
| SI-4 | OSPS-BR-04, OSPS-DO-02, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-04, OSPS-VM-04 |
| SI-5 | OSPS-BR-04, OSPS-DO-02, OSPS-DO-05, OSPS-VM-04 |
| SI-7 | OSPS-BR-01, OSPS-BR-02, OSPS-BR-06, OSPS-DO-03 |
| SI-7(14) | OSPS-BR-06, OSPS-DO-03 |
| SR-3 | OSPS-BR-05, OSPS-DO-06, OSPS-QA-02, OSPS-QA-03, OSPS-QA-05, OSPS-QA-06, OSPS-QA-07, OSPS-SA-03 |
| SR-3(3) | OSPS-SA-03 |
| SR-4 | OSPS-BR-02, OSPS-QA-02 |
| SR-5 | OSPS-DO-06 |
| SR-6 | OSPS-DO-06, OSPS-SA-03 |
| SR-7 | OSPS-DO-06, OSPS-SA-03 |

## OpenSSF Best Practices Badge

Version 2024 · [Framework](https://github.com/coreinfrastructure/best-practices-badge/blob/main/criteria/criteria.yml) · [Mapping document](https://grc.store/openssf/osps-baseline-to-bpb)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| A-B-1 | OSPS-BR-04, OSPS-VM-05, OSPS-VM-06 |
| A-B-3 | OSPS-VM-05, OSPS-VM-06 |
| A-B-8 | OSPS-VM-05, OSPS-VM-06 |
| A-S-1 | OSPS-BR-04, OSPS-DO-06, OSPS-VM-05, OSPS-VM-06 |
| B-B-1 | OSPS-DO-01, OSPS-SA-01 |
| B-B-10 | OSPS-SA-02 |
| B-B-11 | OSPS-BR-03 |
| B-B-12 | OSPS-GV-02 |
| B-B-3 | OSPS-DO-02, OSPS-GV-02 |
| B-B-4 | OSPS-GV-03 |
| B-B-4+ | OSPS-GV-03, OSPS-GV-04 |
| B-B-5 | OSPS-GV-04 |
| B-B-6 | OSPS-LE-02 |
| B-B-7 | OSPS-LE-02 |
| B-B-8 | OSPS-LE-03 |
| B-B-9 | OSPS-DO-01 |
| B-G-3 | OSPS-QA-07 |
| B-S-1 | OSPS-LE-01 |
| B-S-3 | OSPS-GV-01, OSPS-GV-03, OSPS-GV-04 |
| B-S-4 | OSPS-GV-01 |
| B-S-7 | OSPS-DO-01, OSPS-SA-01, OSPS-SA-02 |
| B-S-8 | OSPS-SA-01, OSPS-SA-03, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06 |
| B-S-9 | OSPS-DO-01 |
| CC-B-1 | OSPS-QA-01 |
| CC-B-2 | OSPS-QA-01 |
| CC-B-3 | OSPS-QA-01 |
| CC-B-5 | OSPS-BR-02 |
| CC-B-6 | OSPS-BR-02 |
| CC-B-7 | OSPS-BR-02 |
| CC-B-8 | OSPS-BR-04, OSPS-DO-03 |
| CC-B-9 | OSPS-BR-04 |
| CC-G-1 | OSPS-AC-01 |
| Q-B-10 | OSPS-QA-06 |
| Q-B-12 | OSPS-VM-05, OSPS-VM-06 |
| Q-B-2 | OSPS-BR-05 |
| Q-B-4 | OSPS-QA-06 |
| Q-B-7 | OSPS-BR-04 |
| Q-B-8 | OSPS-QA-06 |
| Q-B-9 | OSPS-QA-06 |
| Q-G-2 | OSPS-GV-03, OSPS-GV-04 |
| Q-S-2 | OSPS-QA-06 |
| Q-S-8 | OSPS-QA-02 |
| Q-S-9 | OSPS-QA-02, OSPS-VM-05, OSPS-VM-06 |
| R-B-1 | OSPS-DO-02, OSPS-GV-03 |
| R-B-1+ | OSPS-DO-02 |
| R-B-2 | OSPS-DO-02 |
| R-B-3 | OSPS-DO-04 |
| R-B-5 | OSPS-QA-01 |
| R-B-6 | OSPS-VM-01 |
| R-B-7 | OSPS-VM-03 |
| R-B-8 | OSPS-VM-01 |
| R-S-2 | OSPS-DO-02, OSPS-VM-01 |
| S-B-14 | OSPS-VM-01, OSPS-VM-05, OSPS-VM-06 |
| S-B-15 | OSPS-VM-01, OSPS-VM-05, OSPS-VM-06 |
| S-B-5 | OSPS-BR-07 |
| S-G-1 | OSPS-SA-03 |

## BSI TR-03185-2 Secure Software Lifecycle for Open Source Software

Version v1.1.0 · [Framework](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03185/BSI-TR-03185-2.pdf?__blob=publicationFile&v=5) · [Mapping document](https://grc.store/openssf/osps-baseline-to-bsi-tr-03185-2)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| BR.01 | OSPS-DO-01, OSPS-DO-03 |
| BR.02 | OSPS-BR-02 |
| BR.03 | OSPS-BR-03, OSPS-BR-06, OSPS-DO-03 |
| BR.04 | OSPS-BR-04 |
| BR.05 | OSPS-QA-05 |
| DE.01 | OSPS-DO-04, OSPS-DO-05 |
| GV.01 | OSPS-GV-03 |
| GV.02 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03 |
| LE.01 | OSPS-LE-02 |
| LE.02 | OSPS-LE-03 |
| QA.01 | OSPS-DO-06, OSPS-QA-02 |
| QA.02 | OSPS-QA-01 |
| QA.03 | OSPS-DO-02, OSPS-GV-02 |
| QA.04 | OSPS-GV-03, OSPS-QA-03, OSPS-QA-06 |
| QA.05 | OSPS-GV-03, OSPS-QA-06, OSPS-VM-06 |
| QA.06 | OSPS-AC-03, OSPS-QA-07 |
| VM.01 | OSPS-VM-01, OSPS-VM-02, OSPS-VM-03 |
| VM.02 | OSPS-VM-04 |

## Cyber Resilience Act

Version 20.11.2024 · [Framework](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#tit_1) · [Mapping document](https://grc.store/openssf/osps-baseline-to-cra)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| 1.1 | OSPS-SA-03 |
| 1.2a | OSPS-SA-01, OSPS-SA-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| 1.2b | OSPS-BR-05, OSPS-DO-01, OSPS-LE-01, OSPS-LE-02, OSPS-LE-03, OSPS-QA-01, OSPS-QA-04, OSPS-QA-05, OSPS-SA-01, OSPS-SA-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| 1.2c | OSPS-DO-02, OSPS-DO-05, OSPS-VM-05, OSPS-VM-06 |
| 1.2d | OSPS-AC-01, OSPS-AC-04, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-DO-03, OSPS-GV-04 |
| 1.2e | OSPS-AC-01, OSPS-AC-04, OSPS-BR-03 |
| 1.2f | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-LE-01, OSPS-QA-01, OSPS-QA-03, OSPS-QA-04 |
| 1.2h | OSPS-BR-04, OSPS-BR-05 |
| 1.2i | OSPS-BR-03 |
| 1.2j | OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-DO-01, OSPS-QA-01, OSPS-SA-03 |
| 1.2k | OSPS-BR-03, OSPS-DO-01, OSPS-QA-03, OSPS-SA-03 |
| 1.2l | OSPS-BR-04, OSPS-DO-02, OSPS-GV-02, OSPS-GV-03, OSPS-GV-04 |
| 2.1 | OSPS-BR-05, OSPS-DO-02, OSPS-DO-06, OSPS-GV-04, OSPS-QA-02, OSPS-VM-01, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| 2.2 | OSPS-BR-05, OSPS-DO-02, OSPS-GV-04, OSPS-QA-02, OSPS-SA-03, OSPS-VM-01, OSPS-VM-05, OSPS-VM-06 |
| 2.3 | OSPS-BR-05, OSPS-GV-02, OSPS-QA-02, OSPS-QA-06, OSPS-VM-01, OSPS-VM-05, OSPS-VM-06 |
| 2.4 | OSPS-GV-02, OSPS-GV-03, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| 2.5 | OSPS-BR-04, OSPS-DO-02, OSPS-GV-04, OSPS-VM-02, OSPS-VM-03 |
| 2.6 | OSPS-DO-02, OSPS-DO-05, OSPS-GV-02, OSPS-GV-04, OSPS-VM-01, OSPS-VM-03, OSPS-VM-04 |
| 2.7 | OSPS-VM-01 |
| 2.8 | OSPS-VM-01 |

## NIST Cybersecurity Framework

Version 2.0 · [Framework](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf) · [Mapping document](https://grc.store/openssf/osps-baseline-to-csf)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| DE.AE-07 | OSPS-SA-03 |
| GV.OC-03 | OSPS-LE-02 |
| GV.OC-04 | OSPS-DO-01 |
| GV.OC-05 | OSPS-DO-01, OSPS-SA-02 |
| GV.PO-01 | OSPS-VM-01, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06 |
| GV.PO-02 | OSPS-VM-01, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06 |
| GV.RM-05 | OSPS-DO-02, OSPS-VM-05, OSPS-VM-06 |
| GV.RM-06 | OSPS-VM-05, OSPS-VM-06 |
| ID.AM-01 | OSPS-QA-02, OSPS-SA-02 |
| ID.AM-02 | OSPS-QA-01, OSPS-QA-02, OSPS-QA-06, OSPS-SA-01 |
| ID.IM-02 | OSPS-QA-03, OSPS-VM-05, OSPS-VM-06 |
| ID.RA-01 | OSPS-QA-01, OSPS-SA-03, OSPS-VM-01, OSPS-VM-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| ID.RA-04 | OSPS-SA-03 |
| ID.RA-05 | OSPS-SA-03 |
| ID.RA-08 | OSPS-QA-01, OSPS-VM-01, OSPS-VM-05, OSPS-VM-06 |
| PR.AA-02 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-GV-04 |
| PR.AA-05 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-GV-04 |
| RS.MA-02 | OSPS-DO-02 |

## ISO/IEC 18974

Version 1.0 - 2023-12 · [Framework](https://openchainproject.org/security-assurance) · [Mapping document](https://grc.store/openssf/osps-baseline-to-iso-18974)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| 4.1 | OSPS-DO-04 |
| 4.1.1 | OSPS-DO-05, OSPS-VM-02 |
| 4.1.2 | OSPS-GV-03, OSPS-GV-04 |
| 4.1.3 | OSPS-VM-02 |
| 4.1.4 | OSPS-DO-01, OSPS-QA-01, OSPS-SA-02 |
| 4.1.5 | OSPS-QA-02, OSPS-QA-03, OSPS-QA-06, OSPS-SA-03, OSPS-VM-01, OSPS-VM-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| 4.2.1 | OSPS-DO-02, OSPS-VM-01, OSPS-VM-05, OSPS-VM-06 |
| 4.2.2 | OSPS-VM-02, OSPS-VM-05, OSPS-VM-06 |
| 4.3.1 | OSPS-DO-04, OSPS-DO-05, OSPS-QA-02 |
| 4.3.2 | OSPS-VM-01, OSPS-VM-05, OSPS-VM-06 |

## Open Cybersecurity Reference Architecture

Version 2024 · [Framework](https://github.com/OWASP/OpenCRE) · [Mapping document](https://grc.store/openssf/osps-baseline-to-opencre)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| 013-021 | OSPS-GV-01 |
| 036-275 | OSPS-DO-01, OSPS-SA-01 |
| 053-751 | OSPS-DO-05, OSPS-DO-06 |
| 068-102 | OSPS-SA-01, OSPS-SA-02, OSPS-SA-03 |
| 072-713 | OSPS-SA-02 |
| 088-377 | OSPS-QA-06, OSPS-VM-05, OSPS-VM-06 |
| 123-124 | OSPS-AC-04, OSPS-GV-04 |
| 124-564 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-QA-01, OSPS-QA-02, OSPS-QA-04, OSPS-QA-05, OSPS-VM-05, OSPS-VM-06 |
| 152-725 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-GV-04 |
| 154-031 | OSPS-SA-03 |
| 155-155 | OSPS-SA-01, OSPS-SA-02, OSPS-VM-05, OSPS-VM-06 |
| 162-655 | OSPS-SA-01 |
| 171-222 | OSPS-DO-03 |
| 201-246 | OSPS-AC-01 |
| 207-435 | OSPS-QA-06, OSPS-VM-05, OSPS-VM-06 |
| 208-355 | OSPS-BR-04 |
| 253-452 | OSPS-QA-03 |
| 263-184 | OSPS-AC-04, OSPS-BR-03, OSPS-BR-04, OSPS-QA-03 |
| 326-704 | OSPS-SA-01 |
| 333-858 | OSPS-AC-01 |
| 347-352 | OSPS-AC-01, OSPS-BR-01, OSPS-BR-04, OSPS-BR-05 |
| 368-633 | OSPS-AC-02 |
| 464-513 | OSPS-VM-02, OSPS-VM-05, OSPS-VM-06 |
| 486-813 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-QA-01, OSPS-QA-02, OSPS-QA-04, OSPS-QA-05 |
| 611-158 | OSPS-VM-05, OSPS-VM-06 |
| 613-286 | OSPS-DO-06, OSPS-QA-02 |
| 673-475 | OSPS-DO-05, OSPS-QA-02 |
| 715-334 | OSPS-BR-05 |
| 732-148 | OSPS-BR-04 |
| 745-356 | OSPS-BR-04 |
| 757-271 | OSPS-BR-04, OSPS-QA-01, OSPS-VM-05, OSPS-VM-06 |
| 802-056 | OSPS-AC-02 |
| 820-878 | OSPS-SA-02 |
| 863-521 | OSPS-QA-02 |
| 887-750 | OSPS-VM-01 |
| 888-770 | OSPS-SA-03 |

## Payment Card Industry Data Security Standard

Version 4.0.1 · [Framework](https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf) · [Mapping document](https://grc.store/openssf/osps-baseline-to-pcidss)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| 10.2.2 | OSPS-BR-04 |
| 11.1.1 | OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01 |
| 11.1.2 | OSPS-GV-01 |
| 11.2.1 | OSPS-VM-01 |
| 11.3.1 | OSPS-SA-03, OSPS-VM-04 |
| 12.1.1 | OSPS-VM-01, OSPS-VM-02 |
| 12.1.3 | OSPS-GV-01, OSPS-VM-01 |
| 12.10.2 | OSPS-DO-02, OSPS-VM-02, OSPS-VM-03 |
| 12.10.5 | OSPS-DO-01 |
| 12.3.1 | OSPS-SA-01, OSPS-SA-02, OSPS-SA-03 |
| 12.5.1 | OSPS-QA-02 |
| 12.5.2 | OSPS-DO-06, OSPS-GV-01, OSPS-GV-02, OSPS-GV-03 |
| 12.5.3 | OSPS-SA-01 |
| 12.8.1 | OSPS-SA-02 |
| 12.8.5 | OSPS-LE-01 |
| 2.1.1 | OSPS-DO-01, OSPS-DO-04, OSPS-DO-06, OSPS-GV-03, OSPS-GV-04, OSPS-QA-01, OSPS-VM-01 |
| 2.1.2 | OSPS-GV-01 |
| 2.2.1 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-03, OSPS-BR-06, OSPS-DO-01, OSPS-SA-01, OSPS-SA-02 |
| 2.2.3 | OSPS-SA-01, OSPS-SA-02 |
| 2.2.4 | OSPS-SA-01, OSPS-SA-02, OSPS-SA-03 |
| 2.2.5 | OSPS-SA-01, OSPS-SA-02, OSPS-SA-03 |
| 2.2.6 | OSPS-SA-01, OSPS-SA-02, OSPS-SA-03 |
| 2.2.7 | OSPS-BR-03, OSPS-BR-06 |
| 3.1.1 | OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01 |
| 3.1.2 | OSPS-GV-01 |
| 3.2.1 | OSPS-DO-04, OSPS-DO-05, OSPS-LE-02, OSPS-LE-03 |
| 3.5.1 | OSPS-BR-06, OSPS-DO-03 |
| 4.1.1 | OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01 |
| 4.1.2 | OSPS-GV-01 |
| 4.2.1 | OSPS-BR-03, OSPS-BR-06 |
| 4.2.2 | OSPS-BR-03, OSPS-BR-06 |
| 5.1.1 | OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01 |
| 5.1.2 | OSPS-GV-01 |
| 6.1.1 | OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01 |
| 6.1.2 | OSPS-GV-01 |
| 6.2.1 | OSPS-BR-04, OSPS-DO-01, OSPS-DO-03, OSPS-QA-01, OSPS-SA-01, OSPS-SA-02, OSPS-SA-03 |
| 6.2.3 | OSPS-QA-06, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| 6.2.3.1 | OSPS-QA-07, OSPS-SA-03 |
| 6.3.1 | OSPS-QA-03, OSPS-QA-06, OSPS-VM-01, OSPS-VM-03, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| 6.3.2 | OSPS-DO-02, OSPS-DO-05, OSPS-DO-06, OSPS-QA-02, OSPS-QA-03, OSPS-QA-06, OSPS-SA-03, OSPS-VM-01, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| 6.3.3 | OSPS-DO-02, OSPS-DO-04, OSPS-VM-02, OSPS-VM-03, OSPS-VM-04 |
| 6.4.1 | OSPS-BR-01, OSPS-BR-03, OSPS-BR-04, OSPS-BR-06, OSPS-VM-05, OSPS-VM-06 |
| 6.4.2 | OSPS-QA-04, OSPS-QA-06, OSPS-QA-07, OSPS-SA-03, OSPS-VM-05, OSPS-VM-06 |
| 6.4.3 | OSPS-BR-02, OSPS-BR-05, OSPS-DO-06, OSPS-QA-02, OSPS-QA-05 |
| 6.5.1 | OSPS-BR-04, OSPS-DO-02, OSPS-QA-01 |
| 6.5.2 | OSPS-BR-04, OSPS-DO-02, OSPS-QA-01, OSPS-QA-03, OSPS-VM-06 |
| 6.5.4 | OSPS-GV-01, OSPS-GV-03, OSPS-GV-04, OSPS-QA-07 |
| 7.1.1 | OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01 |
| 7.1.2 | OSPS-GV-01 |
| 8.1.1 | OSPS-DO-01, OSPS-DO-03, OSPS-DO-04, OSPS-DO-05, OSPS-DO-06, OSPS-GV-01, OSPS-SA-01, OSPS-VM-01 |
| 8.1.2 | OSPS-GV-01 |
| 8.2.1 | OSPS-AC-01, OSPS-AC-04, OSPS-GV-03, OSPS-GV-04 |
| 8.2.2 | OSPS-GV-04 |
| 8.3.1 | OSPS-AC-01 |
| 8.3.2 | OSPS-BR-03, OSPS-BR-06 |

## Proactive Software Supply Chain Risk Management Framework

Version 1.0 · [Framework](https://arxiv.org/pdf/2404.12300) · [Mapping document](https://grc.store/openssf/osps-baseline-to-psscrm)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| D1.1 | OSPS-VM-01, OSPS-VM-04 |
| D1.2 | OSPS-VM-01 |
| D1.3 | OSPS-VM-01 |
| D1.5 | OSPS-VM-01 |
| D2.2 | OSPS-BR-01 |
| E1.1 | OSPS-BR-03 |
| E1.2 | OSPS-AC-01, OSPS-AC-02, OSPS-BR-02 |
| E1.3 | OSPS-AC-01 |
| E1.4 | OSPS-AC-01 |
| E1.5 | OSPS-AC-03 |
| E1.6 | OSPS-DO-04, OSPS-DO-05 |
| E2.1 | OSPS-BR-02, OSPS-BR-04, OSPS-BR-06, OSPS-QA-02 |
| E2.2 | OSPS-BR-03, OSPS-BR-05, OSPS-BR-06, OSPS-QA-01, OSPS-QA-02 |
| E2.3 | OSPS-BR-05 |
| E2.4 | OSPS-BR-01, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-QA-06 |
| E2.5 | OSPS-BR-01, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-QA-06 |
| E2.6 | OSPS-BR-02, OSPS-BR-06, OSPS-DO-03 |
| E3.1 | OSPS-AC-01, OSPS-AC-03, OSPS-BR-04, OSPS-GV-01, OSPS-GV-04, OSPS-LE-01 |
| E3.3 | OSPS-AC-02, OSPS-GV-01, OSPS-GV-04 |
| E3.4 | OSPS-SA-01, OSPS-SA-02 |
| E3.5 | OSPS-DO-01 |
| E3.6 | OSPS-BR-04 |
| E3.7 | OSPS-SA-01, OSPS-SA-02 |
| G1.2 | OSPS-LE-02, OSPS-LE-03 |
| G1.3 | OSPS-DO-03 |
| G1.4 | OSPS-BR-02, OSPS-BR-04, OSPS-DO-06, OSPS-QA-02 |
| G1.5 | OSPS-QA-02 |
| G2.2 | OSPS-QA-03, OSPS-QA-04, OSPS-VM-04 |
| G2.3 | OSPS-GV-01 |
| G2.4 | OSPS-DO-06, OSPS-GV-03, OSPS-QA-07 |
| G2.5 | OSPS-DO-03, OSPS-QA-02 |
| G2.6 | OSPS-AC-01 |
| G4.3 | OSPS-SA-03 |
| G5.1 | OSPS-DO-01, OSPS-SA-01 |
| G5.2 | OSPS-SA-03 |
| G5.3 | OSPS-QA-03 |
| G5.4 | OSPS-QA-03, OSPS-QA-04, OSPS-VM-05, OSPS-VM-06 |
| P1.1 | OSPS-SA-01 |
| P1.2 | OSPS-BR-06, OSPS-DO-03 |
| P2.1 | OSPS-SA-03 |
| P2.2 | OSPS-GV-03 |
| P2.3 | OSPS-AC-02, OSPS-BR-01 |
| P3.1 | OSPS-BR-05, OSPS-DO-03, OSPS-DO-06, OSPS-QA-02 |
| P3.2 | OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-06, OSPS-DO-03, OSPS-DO-06, OSPS-QA-02 |
| P3.3 | OSPS-AC-01, OSPS-BR-06, OSPS-DO-03, OSPS-QA-07 |
| P3.4 | OSPS-DO-06 |
| P3.5 | OSPS-AC-03, OSPS-BR-01, OSPS-BR-05, OSPS-QA-01, OSPS-QA-03, OSPS-QA-07 |
| P4.1 | OSPS-QA-03, OSPS-QA-06, OSPS-VM-05, OSPS-VM-06 |
| P4.2 | OSPS-QA-03, OSPS-QA-06, OSPS-VM-05, OSPS-VM-06 |
| P4.3 | OSPS-QA-06, OSPS-VM-05, OSPS-VM-06 |
| P4.4 | OSPS-QA-06, OSPS-VM-05, OSPS-VM-06 |
| P4.5 | OSPS-VM-05, OSPS-VM-06 |
| P5.1 | OSPS-QA-02 |
| P5.2 | OSPS-QA-02 |

## OWASP Software Assurance Maturity Model

Version 2.0 · [Framework](https://owaspsamm.org/model/) · [Mapping document](https://grc.store/openssf/osps-baseline-to-samm)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| Design - Security Requirements - Supplier Security Lvl2 | OSPS-DO-06 |
| Design - Threat Assessment - Application Risk Profile Lvl1 | OSPS-SA-03 |
| Design - Threat Assessment - Threat Modeling Lvl1 | OSPS-SA-03 |
| Governance - Policy & Compliance - Policy & Standards Lvl1 | OSPS-VM-01 |
| Governance - Policy & Compliance - Policy & Standards Lvl2 | OSPS-VM-02 |
| Governance - Strategy & Metrics - Create and Promote Lvl1 | OSPS-SA-03 |
| Governance - Strategy & Metrics - Create and Promote Lvl2 | OSPS-VM-01 |
| Implementation - Defect Management - Defect Tracking Lvl1 | OSPS-DO-02, OSPS-VM-01 |
| Implementation - Defect Management - Defect Tracking Lvl2 | OSPS-DO-02, OSPS-VM-01 |
| Implementation - Defect Management - Defect Tracking Lvl3 | OSPS-VM-01 |
| Implementation - Secure Build - Build Process Lvl1 | OSPS-QA-01 |
| Implementation - Secure Build - Build Process Lvl2 | OSPS-BR-05 |
| Implementation - Secure Build - Build Process Lvl3 | OSPS-QA-03, OSPS-VM-05, OSPS-VM-06 |
| Implementation - Secure Build - Software Dependencies Lvl1 | OSPS-QA-02 |
| Implementation - Secure Build - Software Dependencies Lvl3 | OSPS-QA-03, OSPS-VM-05, OSPS-VM-06 |
| Implementation - Secure Deployment - Deployment Process Lvl3 | OSPS-BR-06 |
| Operations - Environment Management - Configuration Hardening Lvl1 | OSPS-AC-01, OSPS-AC-04 |
| Operations - Incident Management - Incident Response Lvl1 | OSPS-VM-01 |
| Operations - Incident Management - Incident Response Lvl2 | OSPS-VM-01 |
| Operations - Incident Management - Incident Response Lvl3 | OSPS-VM-01, OSPS-VM-03 |
| Operations - Operational Management - Data Protection Lvl2 | OSPS-SA-01 |
| Operations - Operational Management - System Decommissioning / Legacy Management Lvl1 | OSPS-DO-04, OSPS-DO-05 |
| Operations - Operational Management - System Decommissioning / Legacy Management Lvl2 | OSPS-DO-05 |
| Verification - Architecture Assessment - Architecture Mitigation Lvl2 | OSPS-SA-03 |
| Verification - Requirements-driven Testing - Control Verification Lvl1 | OSPS-QA-03, OSPS-QA-06 |
| Verification - Requirements-driven Testing - Control Verification Lvl2 | OSPS-QA-03, OSPS-QA-06 |
| Verification - Requirements-driven Testing - Control Verification Lvl3 | OSPS-QA-03, OSPS-QA-06 |
| Verification - Security Testing - Scalable Baseline Lvl1 | OSPS-VM-05, OSPS-VM-06 |
| Verification - Security Testing - Scalable Baseline Lvl3 | OSPS-QA-06, OSPS-VM-05, OSPS-VM-06 |

## OpenSSF Scorecard

Version 5.0 · [Framework](https://github.com/ossf/scorecard) · [Mapping document](https://grc.store/openssf/osps-baseline-to-scorecard)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| Binary-Artifacts | OSPS-QA-05 |
| Branch-Protection | OSPS-AC-03 |
| CI-Tests | OSPS-QA-06 |
| Code-Review | OSPS-QA-07 |
| Dangerous-Workflow | OSPS-BR-01 |
| License | OSPS-LE-02, OSPS-LE-03 |
| Pinned-Dependencies | OSPS-DO-06 |
| SAST | OSPS-VM-06 |
| Security-Policy | OSPS-VM-01, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06 |
| Signed-Releases | OSPS-BR-06 |
| Vulnerabilities | OSPS-VM-05, OSPS-VM-06 |

## Supply-chain Levels for Software Artifacts

Version 1.0 · [Framework](https://github.com/slsa-framework/slsa) · [Mapping document](https://grc.store/openssf/osps-baseline-to-slsa)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| Build platform - Isolation strength - Isolated | OSPS-AC-04, OSPS-BR-04, OSPS-BR-05, OSPS-QA-01, OSPS-QA-04 |
| Build platform - Provenance generation - Authentic | OSPS-BR-02 |
| Build platform - Provenance generation - Exists | OSPS-BR-02 |
| Choose an appropriate build platform | OSPS-AC-04, OSPS-BR-01, OSPS-BR-03, OSPS-BR-04 |
| Distribute provenance | OSPS-BR-06 |
| Follow a consistent build process | OSPS-BR-02, OSPS-BR-04 |

## Secure Software Development Framework

Version 1.1 · [Framework](https://csrc.nist.gov/pubs/sp/800/218/final) · [Mapping document](https://grc.store/openssf/osps-baseline-to-ssdf)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| PO.1 | OSPS-SA-01 |
| PO.1.1 | OSPS-BR-07 |
| PO.2 | OSPS-AC-02, OSPS-AC-04, OSPS-GV-04, OSPS-SA-01 |
| PO.3.1 | OSPS-BR-07 |
| PO.3.2 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-05, OSPS-GV-04, OSPS-LE-01, OSPS-LE-02, OSPS-LE-03, OSPS-QA-04, OSPS-SA-01 |
| PO.3.3 | OSPS-QA-02 |
| PO.4 | OSPS-VM-05, OSPS-VM-06 |
| PO.4.1 | OSPS-QA-03, OSPS-QA-04, OSPS-VM-04 |
| PO.4.2 | OSPS-BR-07, OSPS-DO-03, OSPS-DO-04 |
| PO.5.1 | OSPS-BR-07, OSPS-SA-03 |
| PO.5.2 | OSPS-BR-01, OSPS-BR-03, OSPS-BR-06 |
| PS.1 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-LE-01, OSPS-QA-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-04, OSPS-QA-05 |
| PS.2 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01, OSPS-BR-02, OSPS-BR-03, OSPS-BR-04, OSPS-BR-05, OSPS-BR-06, OSPS-DO-03, OSPS-QA-01, OSPS-QA-02, OSPS-QA-03, OSPS-QA-04, OSPS-QA-05 |
| PS.2.1 | OSPS-BR-06, OSPS-DO-03 |
| PS.3 | OSPS-BR-02, OSPS-BR-04, OSPS-GV-02, OSPS-QA-01 |
| PS.3.1 | OSPS-DO-03, OSPS-DO-04 |
| PS.3.2 | OSPS-QA-02 |
| PW.1.1 | OSPS-SA-03 |
| PW.1.2 | OSPS-BR-04, OSPS-BR-07, OSPS-DO-01, OSPS-DO-02, OSPS-GV-02, OSPS-GV-03, OSPS-LE-01, OSPS-QA-01, OSPS-SA-02, OSPS-VM-05, OSPS-VM-06 |
| PW.1.3 | OSPS-BR-07 |
| PW.2.1 | OSPS-LE-01, OSPS-QA-01 |
| PW.4 | OSPS-QA-02 |
| PW.5.1 | OSPS-BR-07 |
| PW.6.2 | OSPS-BR-06 |
| PW.8.1 | OSPS-VM-05, OSPS-VM-06 |
| PW.8.2 | OSPS-QA-06 |
| RV.1.1 | OSPS-DO-02 |
| RV.1.2 | OSPS-DO-02, OSPS-QA-03, OSPS-QA-04, OSPS-VM-05, OSPS-VM-06 |
| RV.1.3 | OSPS-DO-03, OSPS-DO-04, OSPS-VM-01, OSPS-VM-02, OSPS-VM-05, OSPS-VM-06 |
| RV.2.1 | OSPS-DO-02, OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |
| RV.2.2 | OSPS-VM-04, OSPS-VM-05, OSPS-VM-06 |

## United Kingdom National Cyber Security Centre Software Security Code of Practice

Version 2025-05-07 · [Framework](https://www.ncsc.gov.uk/guidance/software-security-code-of-practice-assurance-principles-claims) · [Mapping document](https://grc.store/openssf/osps-baseline-to-uksscop)

| Requirement | OSPS Baseline Controls |
|-------------|------------------------|
| 1.1 | OSPS-DO-02 |
| 1.2 | OSPS-DO-06, OSPS-VM-05 |
| 1.3 | OSPS-DO-02, OSPS-VM-06 |
| 1.4 | OSPS-VM-06 |
| 3.1 | OSPS-DO-03 |
| 3.2 | OSPS-VM-02, OSPS-VM-03 |
| 3.3 | OSPS-DO-06, OSPS-VM-05 |
| 3.4 | OSPS-VM-04 |
| 3.5 | OSPS-DO-05, OSPS-VM-04 |
| 4.1 | OSPS-DO-01, OSPS-DO-04, OSPS-DO-05 |
| 4.2 | OSPS-DO-04 |
| 4.3 | OSPS-VM-04 |
| Claim 1.1.4 | OSPS-AC-03, OSPS-BR-02, OSPS-BR-04 |
| Claim 1.1.5 | OSPS-SA-01, OSPS-SA-02 |
| Claim 1.2.1 | OSPS-BR-05, OSPS-DO-06, OSPS-QA-02 |
| Claim 1.2.2 | OSPS-BR-06, OSPS-DO-06, OSPS-QA-02 |
| Claim 1.2.5 | OSPS-BR-05 |
| Claim 1.3.2 | OSPS-QA-03 |
| Claim 1.3.3 | OSPS-QA-03 |
| Claim 1.4.1 | OSPS-SA-03 |
| Claim 1.4.2 | OSPS-AC-01 |
| Claim 1.4.3 | OSPS-BR-07 |
| Claim 1.4.5 | OSPS-BR-07 |
| Claim 2.1.1 | OSPS-AC-04, OSPS-GV-01, OSPS-GV-03 |
| Claim 2.1.2 | OSPS-BR-01 |
| Claim 2.1.3 | OSPS-AC-04 |
| Claim 2.1.5 | OSPS-AC-01 |
| Claim 2.2.2 | OSPS-AC-01, OSPS-AC-02, OSPS-AC-03, OSPS-AC-04, OSPS-BR-01 |
| Claim 2.2.3 | OSPS-BR-04, OSPS-QA-01 |
| Claim 3.1.1 | OSPS-BR-02, OSPS-BR-04, OSPS-BR-06, OSPS-QA-02 |
| Claim 3.1.2 | OSPS-BR-03 |
| Claim 3.4.1 | OSPS-VM-01 |
| Claim 3.4.2 | OSPS-BR-02 |
| Claim 3.5.1 | OSPS-VM-01 |
| Claim 4.1.1 | OSPS-DO-04, OSPS-DO-05 |
| Claim 4.1.2 | OSPS-DO-04, OSPS-VM-01 |
| Claim 4.2.1 | OSPS-DO-04, OSPS-DO-05 |