ISO/IEC 18974 defines the key requirements of a quality open source security assurance program
How Does ISO/IEC 18974 Work?
ISO/IEC 18974 helps organizations check open source for known security vulnerability issues like CVEs, GitHub dependency alerts or package manager alerts.
ISO/IEC 18974 identifies:
- The key places to have security processes
- How to assign roles and responsibilities
- And how to ensure sustainability of the processes
ISO/IEC 18974 is lightweight, easy to read and is supported by our global community with free reference material and conformance resources.
What Should You Do?
You can adopt ISO/IEC 18974 through self-certification or in collaboration with one of our official partners.
Read ISO/IEC 18974:
Note: the OpenChain version and the ISO version are functionally identical.
Conformance to one is the same as conformance to the other.
Adopt ISO/IEC 18974:
Already Conformant? Let Us Know About Your Adoption:
Past Versions of the Standard:
Releases as a Specification:
Releases as a Guide:
History of ISO/IEC 18974
This specification is built from the source material of ISO/IEC 5230, the International Standard for open source license compliance (specifically OpenChain 2.1, which became ISO/IEC 5230 via the JTC-1 PAS Transposition Process).
This specification was drafted by our community as a Security Assurance Reference Guide due to interest in applying ISO/IEC 5230 processes to the security domain. The draft specification went through a review process via our specification list and calls before a governing board vote to transform it into a published security specification on 2022-09-14.
Improving ISO/IEC 18974
ISO/IEC 18974, the industry standard for open source security assurance, is available for everyone to review, adopt and to submit suggestions for improvement. We collect these comments on the ISO/IEC 18974 GitHub Repository. You can add your comments in the “Issues” section.
You can also send questions and feedback to the mailing list or by email to the OpenChain Project administration team if you prefer to remain anonymous. We discuss the suggestions on our calls and via our mailing lists to decide what to refine, update or improve in future versions.
