The ISO/IEC 18974 items a pipeline satisfies
This page focuses on ISO/IEC 18974 (Open Source Security Assurance). It shows which of the standard's requirements the implementation in this DevSecOps guide satisfies. The license compliance standard ISO/IEC 5230 is outside the scope of this guide.
The Requirements Detail Matrix is the canonical source for the per-item certification question and verification material. What the two standards require is summarized in Standard requirements at a glance. This page covers only the 18974 items a DevSecOps pipeline can implement.
Mapping the DevSecOps implementation to requirements
The table below shows how the DevSecOps pipeline built in this guide meets the key requirements of ISO/IEC 18974.
| Requirement | Requirement (summary) | Implementation | Related pages |
|---|---|---|---|
| 4.1.1 | Document the security assurance policy | DevSecOps strategy / SLA policy document | Adoption Strategy |
| 4.1.3 | Participant awareness of policy and procedures | Pipeline failure guidance and documented procedures | Pipeline Design |
| 4.3.1 | Continuous SBOM recording and archiving | Auto-generated syft SBOM, archived per release | SCA, Monitoring |
| 4.3.2 | Detect and act on known vulnerabilities | grype CVE scan with PR blocking, SLA and exception process | SCA |
| 4.3.2 | Post-release monitoring and new-CVE response | Scheduled scans, Dependabot and Renovate tracking | Monitoring |
| 4.4.1 | Evidence that all requirements are met | Scan results and SBOM artifacts retained as evidence | Monitoring |
Organizational requirements — a public channel for third-party vulnerability inquiries (§4.2.1) and documented roles, staffing, and budget (§4.2.2) — are covered by the governance-track deliverables, not by the CI pipeline. Use the Requirements Detail Matrix as the canonical reference for the full item list and evidence.
Self-certification preparation checklist
OpenChain self-certification is declaration-based, but you must be able to provide evidence if an audit is requested.
- Security policy documents
- DevSecOps introduction strategy document (based on strategy.md)
- SLA definition document by vulnerability severity
- Exception-handling approval process document
- SBOM evidence
- SBOM files automatically generated by CI/CD (retained by release version)
- SBOM generation tool / format / cadence specification document
- Vulnerability management evidence
- grype scan result artifacts
- List of CVEs handled via exception and their approval records (including .grype.yaml comments)
- Vulnerability discovery → remediation history (GitHub Issues·PRs)
- Continuous monitoring evidence
- Scheduled scan workflow execution logs
- Dependabot·Renovate PR history
- New CVE alert → response timeline
Limitations and precautions
DevSecOps scope: The DevSecOps implementation in this guide focuses on the open source security assurance of ISO/IEC 18974. Additional areas such as SAST, DAST, and IaC security are security-hardening activities that go beyond the standard's requirements; they are optional improvements outside the scope of certification.
ISO/IEC 5230 requires separate preparation: The license compliance standard ISO/IEC 5230 is outside the scope of this guide. See the Build Your System guide.
Self-certification declaration: once you have the evidence above, follow the procedure in the self-certification chapter. Registration and validity management live there.