TheArtOfService
Back to Frameworks

OpenSSF Open Source Project Security Baseline (OSPS Baseline)

Self-Assess
International (open source ecosystem)
vv2026.08.28 (current on baseline.openssf.org, read 2026-09-30)
8 domains
64 controls

The OpenSSF Open Source Project Security Baseline v2026.08.28: 64 MUST requirements across access control, build and release, documentation, governance, legal, quality, security assessment and vulnerability management, each assigned to maturity levels 1 to 3 by the project's size and user base.

Verified

OpenSSF Open Source Project Security Baseline (OSPS Baseline) is a compliance framework from International (open source ecosystem) with 8 domains and 64 controls that map to 1 other frameworks. The largest domains are QA: Quality – OpenSSF Open Source Project Security Baseline (OSPS Baseline) (13 controls), BR: Build and Release – OpenSSF Open Source Project Security Baseline (OSPS Baseline) (12 controls), VM: Vulnerability Management – OpenSSF Open Source Project Security Baseline (OSPS Baseline) (10 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (8)

AC: Access Control – OpenSSF Open Source Project Security Baseline (OSPS Baseline)

6 controls
Controls in the AC: Access Control – OpenSSF Open Source Project Security Baseline (OSPS Baseline) domain of OpenSSF Open Source Project Security Baseline (OSPS Baseline) — 6 controls
CodeTitle
openssf-open-source-project-security-baseline-osps-baseline::OSPS-AC-01.01OSPS-AC-01.01 Use MFA for Sensitive Actions
openssf-open-source-project-security-baseline-osps-baseline::OSPS-AC-02.01OSPS-AC-02.01 Restrict Collaborator Permissions
openssf-open-source-project-security-baseline-osps-baseline::OSPS-AC-03.01OSPS-AC-03.01 Protect the Primary Branch from Accidental Modification
openssf-open-source-project-security-baseline-osps-baseline::OSPS-AC-03.02OSPS-AC-03.02 Protect the Primary Branch from Accidental Modification
openssf-open-source-project-security-baseline-osps-baseline::OSPS-AC-04.01OSPS-AC-04.01 Enforce Least Privilege on CI/CD Pipelines
openssf-open-source-project-security-baseline-osps-baseline::OSPS-AC-04.02OSPS-AC-04.02 Enforce Least Privilege on CI/CD Pipelines

BR: Build and Release – OpenSSF Open Source Project Security Baseline (OSPS Baseline)

12 controls
Controls in the BR: Build and Release – OpenSSF Open Source Project Security Baseline (OSPS Baseline) domain of OpenSSF Open Source Project Security Baseline (OSPS Baseline) — 12 controls
CodeTitle
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-01.01OSPS-BR-01.01 Prevent Untrusted Input When Building & Releasing
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-01.03OSPS-BR-01.03 Prevent Untrusted Input When Building & Releasing
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-01.04OSPS-BR-01.04 Prevent Untrusted Input When Building & Releasing
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-02.01OSPS-BR-02.01 Assign Unique Version Identifiers
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-02.02OSPS-BR-02.02 Assign Unique Version Identifiers
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-03.01OSPS-BR-03.01 Use Encrypted Channels for Development & Release Activity
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-03.02OSPS-BR-03.02 Use Encrypted Channels for Development & Release Activity
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-04.01OSPS-BR-04.01 Publish Change Log With Release
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-05.01OSPS-BR-05.01 Use Standardized Dependency Management Tools
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-06.01OSPS-BR-06.01 Include Signatures and Hashes With Release
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-07.01OSPS-BR-07.01 Secure Secrets and Credentials
openssf-open-source-project-security-baseline-osps-baseline::OSPS-BR-07.02OSPS-BR-07.02 Secure Secrets and Credentials

DO: Documentation – OpenSSF Open Source Project Security Baseline (OSPS Baseline)

8 controls
Controls in the DO: Documentation – OpenSSF Open Source Project Security Baseline (OSPS Baseline) domain of OpenSSF Open Source Project Security Baseline (OSPS Baseline) — 8 controls
CodeTitle
openssf-open-source-project-security-baseline-osps-baseline::OSPS-DO-01.01OSPS-DO-01.01 Publish User Guides for Basic Functionality
openssf-open-source-project-security-baseline-osps-baseline::OSPS-DO-02.01OSPS-DO-02.01 Provide Mechanisms for Reporting Defects
openssf-open-source-project-security-baseline-osps-baseline::OSPS-DO-03.01OSPS-DO-03.01 Publish Provenance Verification Instructions
openssf-open-source-project-security-baseline-osps-baseline::OSPS-DO-03.02OSPS-DO-03.02 Publish Provenance Verification Instructions
openssf-open-source-project-security-baseline-osps-baseline::OSPS-DO-04.01OSPS-DO-04.01 Publish Support Scope and Duration
openssf-open-source-project-security-baseline-osps-baseline::OSPS-DO-05.01OSPS-DO-05.01 Document Security Update Scope and Duration
openssf-open-source-project-security-baseline-osps-baseline::OSPS-DO-06.01OSPS-DO-06.01 Publish Dependency Management Policy
openssf-open-source-project-security-baseline-osps-baseline::OSPS-DO-07.01OSPS-DO-07.01 Provide Instructions on How to Build From Source

GV: Governance – OpenSSF Open Source Project Security Baseline (OSPS Baseline)

6 controls
Controls in the GV: Governance – OpenSSF Open Source Project Security Baseline (OSPS Baseline) domain of OpenSSF Open Source Project Security Baseline (OSPS Baseline) — 6 controls
CodeTitle
openssf-open-source-project-security-baseline-osps-baseline::OSPS-GV-01.01OSPS-GV-01.01 Publish Project Roles and Responsibilities
openssf-open-source-project-security-baseline-osps-baseline::OSPS-GV-01.02OSPS-GV-01.02 Publish Project Roles and Responsibilities
openssf-open-source-project-security-baseline-osps-baseline::OSPS-GV-02.01OSPS-GV-02.01 Provide Public Discussion Mechanisms
openssf-open-source-project-security-baseline-osps-baseline::OSPS-GV-03.01OSPS-GV-03.01 Publish Contribution Guide
openssf-open-source-project-security-baseline-osps-baseline::OSPS-GV-03.02OSPS-GV-03.02 Publish Contribution Guide
openssf-open-source-project-security-baseline-osps-baseline::OSPS-GV-04.01OSPS-GV-04.01 Require Formal Review of Permission Grants

LE: Legal – OpenSSF Open Source Project Security Baseline (OSPS Baseline)

5 controls
Controls in the LE: Legal – OpenSSF Open Source Project Security Baseline (OSPS Baseline) domain of OpenSSF Open Source Project Security Baseline (OSPS Baseline) — 5 controls
CodeTitle
openssf-open-source-project-security-baseline-osps-baseline::OSPS-LE-01.01OSPS-LE-01.01 Require Code Contributors to Assert Right to Commit
openssf-open-source-project-security-baseline-osps-baseline::OSPS-LE-02.01OSPS-LE-02.01 Ensure Project Licenses are Fully Open Source
openssf-open-source-project-security-baseline-osps-baseline::OSPS-LE-02.02OSPS-LE-02.02 Ensure Project Licenses are Fully Open Source
openssf-open-source-project-security-baseline-osps-baseline::OSPS-LE-03.01OSPS-LE-03.01 Maintain and Release Licenses in a Well Known Location
openssf-open-source-project-security-baseline-osps-baseline::OSPS-LE-03.02OSPS-LE-03.02 Maintain and Release Licenses in a Well Known Location

QA: Quality – OpenSSF Open Source Project Security Baseline (OSPS Baseline)

13 controls
Controls in the QA: Quality – OpenSSF Open Source Project Security Baseline (OSPS Baseline) domain of OpenSSF Open Source Project Security Baseline (OSPS Baseline) — 13 controls
CodeTitle
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-01.01OSPS-QA-01.01 Publish Source Code and Change History
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-01.02OSPS-QA-01.02 Publish Source Code and Change History
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-02.01OSPS-QA-02.01 Publish Software Dependencies
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-02.02OSPS-QA-02.02 Publish Software Dependencies
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-03.01OSPS-QA-03.01 Address Pass/Fail Checks Before Accepting Changes
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-04.01OSPS-QA-04.01 Enforce Security Requirements on All Codebases
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-04.02OSPS-QA-04.02 Enforce Security Requirements on All Codebases
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-05.01OSPS-QA-05.01 Prevent Executables in the Codebase
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-05.02OSPS-QA-05.02 Prevent Executables in the Codebase
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-06.01OSPS-QA-06.01 Use Automated Testing in CI/CD Pipelines
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-06.02OSPS-QA-06.02 Use Automated Testing in CI/CD Pipelines
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-06.03OSPS-QA-06.03 Use Automated Testing in CI/CD Pipelines
openssf-open-source-project-security-baseline-osps-baseline::OSPS-QA-07.01OSPS-QA-07.01 Require Merge Approvals

SA: Security Assessment – OpenSSF Open Source Project Security Baseline (OSPS Baseline)

4 controls
Controls in the SA: Security Assessment – OpenSSF Open Source Project Security Baseline (OSPS Baseline) domain of OpenSSF Open Source Project Security Baseline (OSPS Baseline) — 4 controls
CodeTitle
openssf-open-source-project-security-baseline-osps-baseline::OSPS-SA-01.01OSPS-SA-01.01 Publish Design Descriptions of System Actors and Actions
openssf-open-source-project-security-baseline-osps-baseline::OSPS-SA-02.01OSPS-SA-02.01 Publish External Interface Descriptions
openssf-open-source-project-security-baseline-osps-baseline::OSPS-SA-03.01OSPS-SA-03.01 Maintain a Project Security Assessment
openssf-open-source-project-security-baseline-osps-baseline::OSPS-SA-03.02OSPS-SA-03.02 Maintain a Project Security Assessment

VM: Vulnerability Management – OpenSSF Open Source Project Security Baseline (OSPS Baseline)

10 controls
Controls in the VM: Vulnerability Management – OpenSSF Open Source Project Security Baseline (OSPS Baseline) domain of OpenSSF Open Source Project Security Baseline (OSPS Baseline) — 10 controls
CodeTitle
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-01.01OSPS-VM-01.01 Publish Coordinated Vulnerability Disclosure Policy
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-02.01OSPS-VM-02.01 Publish Contacts and Process for Reporting Vulnerabilities.
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-03.01OSPS-VM-03.01 Maintain Private Vulnerability Reporting Process
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-04.01OSPS-VM-04.01 Publish Discovered Vulnerabilities
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-04.02OSPS-VM-04.02 Publish Discovered Vulnerabilities
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-05.01OSPS-VM-05.01 Publish and Enforce a Dependency Remediation Policy
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-05.02OSPS-VM-05.02 Publish and Enforce a Dependency Remediation Policy
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-05.03OSPS-VM-05.03 Publish and Enforce a Dependency Remediation Policy
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-06.01OSPS-VM-06.01 Publish and Enforce an Application Security Testing Policy
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-06.02OSPS-VM-06.02 Publish and Enforce an Application Security Testing Policy

Maps to 1 other framework

64 total controls
NIST SP 800-218
37 source controls mapped|15 target controls covered
58%
Compare OpenSSF Open Source Project Security Baseline (OSPS Baseline) with NIST SP 800-218

Coverage is not the same as your position

This page shows what OpenSSF Open Source Project Security Baseline (OSPS Baseline) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is OpenSSF Open Source Project Security Baseline (OSPS Baseline) and who does it apply to?

OpenSSF Open Source Project Security Baseline (OSPS Baseline) is a compliance framework from International (open source ecosystem) with 8 domains and 64 controls. The OpenSSF Open Source Project Security Baseline v2026.08.28: 64 MUST requirements across access control, build and release, documentation, governance, legal, quality, security assessment and vulnerability management, each assigned to maturity levels 1 to 3 by the project's size and user base. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does OpenSSF Open Source Project Security Baseline (OSPS Baseline) actually require?

OpenSSF Open Source Project Security Baseline (OSPS Baseline) has 64 controls organised across 8 domains. The largest domains are QA: Quality – OpenSSF Open Source Project Security Baseline (OSPS Baseline) (13 controls), BR: Build and Release – OpenSSF Open Source Project Security Baseline (OSPS Baseline) (12 controls), VM: Vulnerability Management – OpenSSF Open Source Project Security Baseline (OSPS Baseline) (10 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of OpenSSF Open Source Project Security Baseline (OSPS Baseline) do I already cover?

OpenSSF Open Source Project Security Baseline (OSPS Baseline) maps to 1 other compliance frameworks. The top mapping partners are NIST SP 800-218 (58% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement OpenSSF Open Source Project Security Baseline (OSPS Baseline)?

Start your OpenSSF Open Source Project Security Baseline (OSPS Baseline) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about OpenSSF Open Source Project Security Baseline (OSPS Baseline) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 64 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 849 frameworks.

Get Started Free →

Free forever — no credit card required