https://korea-wg.openchainproject.org/en/tags/security-assurance/Recent content in Security Assurance on OpenChain KWGHugoenhttps://korea-wg.openchainproject.org/en/guide/iso18974_guide/3-content-review/2-security-assurance/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/iso18974_guide/3-content-review/2-security-assurance/<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">★ 18974 Exclusive Items — Documented Evidence Strength</div> <p>§4.3.2.1·§4.3.2.2 are ISO 18974 exclusive (★) items requiring <strong>Documented Evidence</strong>. Not merely a &ldquo;vulnerability response procedure document,&rdquo; but <strong>actual execution records for each CVE</strong> (scan results, CVSS scores, remediation history, VEX issuance, customer notification history) must be retained. For a detailed explanation of the strength difference, see <a href="https://korea-wg.openchainproject.org/en/guide/iso18974_guide/1-program-foundation/5-standard-practice/#evidence-strength-for-iso-18974-exclusive--items--documented-evidence">§4.1.5 Standard Practices — Documented Evidence Notice</a>.</p> </div> <h2 id="1-clause-overview">1. Clause Overview</h2> <p>§4.3.2 is the core clause of ISO/IEC 18974 and is a new clause exclusive to 18974 that does not exist in ISO/IEC 5230. It requires establishing a procedure covering the entire process — <strong>vulnerability detection → risk assessment → remediation decision → customer consent (where applicable) → remediation → post-deployment newly disclosed vulnerability response → continuous monitoring</strong> — for each open source component in the SBOM, and maintaining implementation records. If §4.1.5 requires the existence of vulnerability handling methods, §4.3.2 requires that those methods have actually been applied to each component with records retained.</p>https://korea-wg.openchainproject.org/en/guide/iso18974_guide/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/iso18974_guide/<p>This guide explains each requirement clause of ISO/IEC 18974 (OpenChain Security Assurance) one by one. It describes what Verification Materials each clause requires, how to comply, and what sample documents can be used immediately.</p> <p><strong>Author : OpenChain Korea Work Group / <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a></strong></p> <h2 id="target-audience">Target Audience</h2> <ul> <li>Security managers and open source program managers at organizations establishing an open source security assurance framework for the first time</li> <li>Engineers building open source vulnerability management processes in DevSecOps environments</li> <li>Organization staff preparing to add ISO/IEC 18974 certification after obtaining ISO/IEC 5230 certification</li> </ul> <h2 id="relationship-with-isoiec-5230">Relationship with ISO/IEC 5230</h2> <div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">ISO/IEC 18974 adds a security layer on top of ISO/IEC 5230</div> <p><strong>ISO/IEC 5230 (License Compliance)</strong> covers the foundational program for systematically managing open source license obligations.</p> <p><strong>ISO/IEC 18974 (Security Assurance)</strong> adds a security layer of vulnerability detection, assessment, and response on top of that foundation. The two standards share core infrastructure such as policy, competence, and SBOM, and 18974 extends and deepens this from a security perspective.</p> <table> <thead> <tr> <th>Category</th> <th>ISO/IEC 5230</th> <th>ISO/IEC 18974</th> </tr> </thead> <tbody> <tr> <td>Purpose</td> <td>License Compliance</td> <td>Security Assurance</td> </tr> <tr> <td>Verification Materials</td> <td>24 items</td> <td>25 items</td> </tr> <tr> <td>Common Foundation Clauses</td> <td>—</td> <td>16 (corresponding to 5230)</td> </tr> <tr> <td>18974-Exclusive Clauses</td> <td>—</td> <td>9 (security-specific)</td> </tr> <tr> <td>Key Additional Elements</td> <td>—</td> <td>Vulnerability detection, response, and CVD procedures</td> </tr> </tbody> </table> </div>