ISO/IEC 18974 Mapping (DevSecOps Implementation)
This page focuses on ISO/IEC 18974 (Open Source Security Assurance). It shows which of the standard's requirements the implementation in this DevSecOps guide satisfies. The license compliance standard ISO/IEC 5230 is outside the scope of this guide.
The Checklist Mapping in the Build Your System guide is the canonical source for the combined mapping of all 5230 and 18974 items. This page covers only the 18974 items that can be implemented with DevSecOps.
What is ISO/IEC 18974?
Hosted by the OpenChain Project, it lets anyone self-certify for free.
Purpose: To define the minimum core requirements for identifying, tracking, and responding to known security vulnerabilities (such as CVEs) in open source software. It focuses on a minimal baseline so that organizations of any size can adopt it without undue burden.
Structure: Consists of four sections — Program Foundation (4.1), Relevant Tasks Defined and Supported (4.2), Open Source Software Content Review and Approval (4.3), and Adherence to the Specification Requirements (4.4). Each requirement is numbered in the format 4.x.x.
Certification method: Complete and submit a self-certification checklist on the official OpenChain site. Because the organization declares conformance itself without an external audit, the process is simple and free.
Mapping the DevSecOps implementation to requirements
The table below shows how the DevSecOps pipeline built in this guide meets the key requirements of ISO/IEC 18974.
| Requirement | Requirement (summary) | Implementation | Related pages |
|---|---|---|---|
| 4.1.1 | Document the security assurance policy | DevSecOps strategy / SLA policy document | Adoption Strategy |
| 4.1.3 | Participant awareness of policy and procedures | Pipeline failure guidance and documented procedures | Pipeline Design |
| 4.3.1 | Continuous SBOM recording and archiving | Auto-generated syft SBOM, archived per release | SCA, Monitoring |
| 4.3.2 | Detect and act on known vulnerabilities | grype CVE scan with PR blocking, SLA and exception process | SCA |
| 4.3.2 | Post-release monitoring and new-CVE response | Scheduled scans, Dependabot and Renovate tracking | Monitoring |
| 4.4.1 | Evidence that all requirements are met | Scan results and SBOM artifacts retained as evidence | Monitoring |
Organizational requirements — a public channel for third-party vulnerability inquiries (§4.2.1) and documented roles, staffing, and budget (§4.2.2) — are covered by the governance-track deliverables, not by the CI pipeline. Use Requirements at a Glance as the canonical reference for the full item list and evidence.
Self-certification preparation checklist
OpenChain self-certification is declaration-based, but you must be able to provide evidence if an audit is requested.
- Security policy documents
- DevSecOps introduction strategy document (based on strategy.md)
- SLA definition document by vulnerability severity
- Exception-handling approval process document
- SBOM evidence
- SBOM files automatically generated by CI/CD (retained by release version)
- SBOM generation tool / format / cadence specification document
- Vulnerability management evidence
- grype scan result artifacts
- List of CVEs handled via exception and their approval records (including .grype.yaml comments)
- Vulnerability discovery → remediation history (GitHub Issues·PRs)
- Continuous monitoring evidence
- Scheduled scan workflow execution logs
- Dependabot·Renovate PR history
- New CVE alert → response timeline
Certification registration process
- Self-assessment: Self-assess the ISO/IEC 18974 items against the official OpenChain checklist and confirm that all requirements are met.
- Declaration: Once you have confirmed that all requirements are met, declare that your organization has a conforming program. Stating this in organizational policy documents is also recommended.
- Registration: Register your organization in the OpenChain Community of Conformance. This is optional but helps improve supply chain trust.
Limitations and precautions
DevSecOps scope: The DevSecOps implementation in this guide focuses on the open source security assurance of ISO/IEC 18974. Additional areas such as SAST, DAST, and IaC security are security-hardening activities that go beyond the standard's requirements; they are optional improvements outside the scope of certification.
ISO/IEC 5230 requires separate preparation: The license compliance standard ISO/IEC 5230 is outside the scope of this guide. See the Build Your System guide.