The ASC library is the organisation's repository of application security controls, each associated with one or more levels of trust, used to group ASCs under the level of trust each belongs to, communicate them and select them in projects. It provides the list of levels of trust (identifier, name, description), the ASCs assigned to each level and a hierarchical list of all ASCs. Sources include controls from previous audits, from risk assessments, from accepted libraries (ISO/IEC 27002, ISO/IEC 15408, NIST SP 800-53) and from third parties, with the originating source identified. The committee builds the library by analysing applications, deriving their security requirements from all ONF components, selecting ASCs, and then updating an existing level of trust, completing it, or creating a new one; a level of trust is only a label for a set of ASCs meeting the requirements of one or more applications, with no prescribed nomenclature or ordering, and third-party ASCs are mapped to the organisation's own levels and attributes.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.