Establish and document a cybersecurity policy for open-source software
- 適用於
- Open-source steward
- 來源引用
- Art. 24(1)
- 產品類別
- default, important-class-i, important-class-ii, critical
通俗語言
As an OSS steward, you must have a written cybersecurity policy that covers how your project develops secure software and how it handles security vulnerabilities when they are discovered. This does not need to be a corporate-style compliance document — it can be a SECURITY.md file, a project security policy, or similar — but it must exist and be documented. The policy must address both secure development practices and vulnerability handling.
Legal text
Article 24(1) of Regulation (EU) 2024/2847 provides that open-source software stewards shall put in place and document a cybersecurity policy to foster the development of a secure product with digital elements, including the open-source software components they provide, and to handle vulnerabilities in an effective manner in accordance with Article 13(6) as it applies to them.
The cybersecurity policy shall address, at minimum:
- the secure development practices applied to the open-source software;
- the vulnerability handling process, including coordinated disclosure.
Key requirements
- Written policy — must be documented (not merely an informal practice)
- Secure development coverage — policy addresses how security is considered during development of the OSS component
- Vulnerability handling — policy covers how vulnerabilities are received, triaged, addressed, and disclosed
- Coordinated disclosure process — clear process for security researchers and users to report vulnerabilities (e.g. SECURITY.md, vulnerability disclosure policy)
- Kept up to date — policy should evolve as the project and threat landscape change
Evidence you may need
- Published security policy document (e.g. SECURITY.md in source repository)
- Vulnerability disclosure policy or coordinated disclosure process document
- Secure development guidelines referenced or applied by the project
- Evidence that the policy is actively followed (e.g. closed CVEs via disclosure process)