TRUSCA

Mon, 01 Jan 0001 00:00:00 +0000

Managing the vulnerabilities and licenses of open source components calls for an SCA (Software Composition Analysis) tool. Several commercial products exist, but some organizations look for an open source tool they can install and run on their own infrastructure.

TRUSCA is a self-hosted SCA portal published for that purpose. Released under Apache 2.0, it brings vulnerabilities (CVE), license compliance, and SBOM management into a single screen. It is developed by Trusted OSS, a project that grew out of KWG community work.

§4.3.2 Security Assurance

Mon, 01 Jan 0001 00:00:00 +0000

★ 18974 Exclusive Items — Documented Evidence Strength

§4.3.2.1·§4.3.2.2 are ISO 18974 exclusive (★) items requiring Documented Evidence. Not merely a “vulnerability response procedure document,” but actual execution records for each CVE (scan results, CVSS scores, remediation history, VEX issuance, customer notification history) must be retained. For a detailed explanation of the strength difference, see §4.1.5 Standard Practices — Documented Evidence Notice.

1. Clause Overview

§4.3.2 is the core clause of ISO/IEC 18974 and is a new clause exclusive to 18974 that does not exist in ISO/IEC 5230. It requires establishing a procedure covering the entire process — vulnerability detection → risk assessment → remediation decision → customer consent (where applicable) → remediation → post-deployment newly disclosed vulnerability response → continuous monitoring — for each open source component in the SBOM, and maintaining implementation records. If §4.1.5 requires the existence of vulnerability handling methods, §4.3.2 requires that those methods have actually been applied to each component with records retained.

Cve on OpenChain KWG

TRUSCA

§4.3.2 Security Assurance

1. Clause Overview