grc.store

Search / openssf/osps-baseline-to-800-161 / v0.0.0-dev-671f23f

Release · v0.0.0-dev-671f23f

openssf/osps-baseline-to-800-161 Mapping Document

openssf/osps-baseline-to-800-161

Cross-walk from the Open Source Project Security (OSPS) Baseline controls to NIST SP 800-161. Each mapping asserts a "relates-to" relationship; strength, confidence-level, and rationale are left unset and should be added as the mappings are individually reviewed.

Published by OSPS Baseline Authors

License No license declared

Install

OCI v1.1
$grcli unpack --repository openssf/osps-baseline-to-800-161 --version v0.0.0-dev-671f23f

grcli unpack verifies this signature against the recorded identity below and fails closed before writing any files — no separate verify step needed. Pass --no-verify to skip.

Coordinate
oci.grc.store/openssf/osps-baseline-to-800-161:v0.0.0-dev-671f23f
Manifest digest
sha256:714cadc5df08c897c5a4f8d4e9010f5b46adfd5772b09cac7e75887a8bfcc529
Signed by
no signature recorded

Identity recorded by this hub when the version was published; unpack (above) checks the signature against it.

Verify in CI — check the signature without downloading
$grcli verify --repository openssf/osps-baseline-to-800-161 --version v0.0.0-dev-671f23f

Read-only: downloads nothing and exits non-zero if the signature or the recorded identity doesn't match — use it as an admission/policy gate.

Provenance

1 layer
Digest Media type Size
1e7cddd60b63… application/vnd.gemara.artifact.v1+yaml 10.0 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "1.2.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "osps-baseline-to-800-161",
            "type": "MappingDocument"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "openssf/osps-baseline-to-800-161",
            "tag": "v0.0.0-dev-671f23f"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/security-baseline",
          "GITHUB_RUN_ATTEMPT": "1",
          "GITHUB_RUN_ID": "26617016306",
          "GITHUB_SHA": "671f23f015e4b0f6108ab8f82f0eba7f89d55dce",
          "GITHUB_WORKFLOW": "Publish to grc.store",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "/home/runner/work/_temp/staged/osps-to-800-161.yaml",
            "uri": "file:///home/runner/work/_temp/staged/osps-to-800-161.yaml",
            "digest": {
              "sha256": "1e7cddd60b63d272567f650f024e0af6821c76ae73601183c7f5d9b65bba60f0"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/security-baseline@671f23f015e4b0f6108ab8f82f0eba7f89d55dce",
            "digest": {
              "gitCommit": "671f23f015e4b0f6108ab8f82f0eba7f89d55dce"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/security-baseline/actions/runs/26617016306",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.2.2"
          }
        },
        "metadata": {
          "invocationId": "26617016306-1",
          "startedOn": "2026-05-29T03:57:18.325360231Z",
          "finishedOn": "2026-05-29T03:57:18.427445221Z"
        },
        "byproducts": [
          {
            "name": "osps-to-800-161.yaml",
            "digest": {
              "sha256": "1e7cddd60b63d272567f650f024e0af6821c76ae73601183c7f5d9b65bba60f0"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "osps-to-800-161.yaml",
      "type": "MappingDocument",
      "id": "osps-baseline-to-800-161",
      "role": "artifact"
    }
  ]
}

No rich preview yet

This UI can't render MappingDocument artifacts richly yet. The raw content is shown below, and the artifact stays pullable via the coordinate above.

mappings:
  - id: M-OSPS-AC-01-800-161
    relationship: relates-to
    source: OSPS-AC-01
    targets:
      - entry-id: AC-4(21)
      - entry-id: AC-17
      - entry-id: CM-5
      - entry-id: CM-6
      - entry-id: IA-2
      - entry-id: IA-5
      - entry-id: 1.2e
      - entry-id: 1.2f
  - id: M-OSPS-AC-02-800-161
    relationship: relates-to
    source: OSPS-AC-02
    targets:
      - entry-id: AC-2
      - entry-id: AC-3
      - entry-id: AC-4(21)
      - entry-id: AC-5
      - entry-id: AC-6
      - entry-id: CM-5
      - entry-id: CM-7
  - id: M-OSPS-AC-03-800-161
    relationship: relates-to
    source: OSPS-AC-03
    targets:
      - entry-id: AC-3
      - entry-id: AC-5
      - entry-id: CM-3
      - entry-id: CM-3(2)
      - entry-id: CM-5
  - id: M-OSPS-AC-04-800-161
    relationship: relates-to
    source: OSPS-AC-04
    targets:
      - entry-id: AC-3(8)
      - entry-id: AC-4
      - entry-id: AC-4(6)
      - entry-id: AC-6
      - entry-id: AC-20
      - entry-id: AC-20(1)
      - entry-id: CM-5
      - entry-id: CM-7
  - id: M-OSPS-BR-01-800-161
    relationship: relates-to
    source: OSPS-BR-01
    targets:
      - entry-id: AC-3
      - entry-id: AC-4
      - entry-id: AC-4(21)
      - entry-id: CM-5
      - entry-id: CM-7
      - entry-id: SI-7
  - id: M-OSPS-BR-02-800-161
    relationship: relates-to
    source: OSPS-BR-02
    targets:
      - entry-id: IA-4
      - entry-id: SA-15
      - entry-id: SI-7
      - entry-id: SR-4
  - id: M-OSPS-BR-03-800-161
    relationship: relates-to
    source: OSPS-BR-03
    targets:
      - entry-id: AC-4
      - entry-id: AC-4(21)
  - id: M-OSPS-BR-04-800-161
    relationship: relates-to
    source: OSPS-BR-04
    targets:
      - entry-id: AU-2
      - entry-id: AU-6
      - entry-id: AU-10
      - entry-id: CM-5
      - entry-id: CM-6
      - entry-id: MA-1
      - entry-id: MA-8
      - entry-id: SI-4
      - entry-id: SI-5
  - id: M-OSPS-BR-05-800-161
    relationship: relates-to
    source: OSPS-BR-05
    targets:
      - entry-id: AC-4
      - entry-id: CM-2
      - entry-id: CM-7(4)
      - entry-id: CM-7(5)
      - entry-id: RA-5
      - entry-id: SA-15
      - entry-id: SR-3
  - id: M-OSPS-BR-06-800-161
    relationship: relates-to
    source: OSPS-BR-06
    targets:
      - entry-id: AU-10
      - entry-id: MP-1
      - entry-id: SA-15
      - entry-id: SI-7
      - entry-id: SI-7(14)
  - id: M-OSPS-DO-01-800-161
    relationship: relates-to
    source: OSPS-DO-01
    targets:
      - entry-id: CM-2
      - entry-id: PL-2
      - entry-id: PL-8
      - entry-id: SA-15
  - id: M-OSPS-DO-02-800-161
    relationship: relates-to
    source: OSPS-DO-02
    targets:
      - entry-id: IR-6
      - entry-id: SI-4
      - entry-id: SI-5
  - id: M-OSPS-DO-03-800-161
    relationship: relates-to
    source: OSPS-DO-03
    targets:
      - entry-id: CM-2
      - entry-id: IR-1
      - entry-id: MP-1
      - entry-id: SA-15
      - entry-id: SI-7
      - entry-id: SI-7(14)
  - id: M-OSPS-DO-04-800-161
    relationship: relates-to
    source: OSPS-DO-04
    targets:
      - entry-id: PL-1
      - entry-id: PL-2
      - entry-id: SI-4
  - id: M-OSPS-DO-05-800-161
    relationship: relates-to
    source: OSPS-DO-05
    targets:
      - entry-id: PL-1
      - entry-id: PL-2
      - entry-id: SI-4
      - entry-id: SI-5
  - id: M-OSPS-DO-06-800-161
    relationship: relates-to
    source: OSPS-DO-06
    targets:
      - entry-id: CA-7
      - entry-id: CM-7(5)
      - entry-id: CM-8
      - entry-id: PM-30
      - entry-id: RA-3(1)
      - entry-id: SA-11
      - entry-id: SI-4
      - entry-id: SR-3
      - entry-id: SR-5
      - entry-id: SR-6
      - entry-id: SR-7
  - id: M-OSPS-GV-01-800-161
    relationship: relates-to
    source: OSPS-GV-01
    targets:
      - entry-id: AC-2
      - entry-id: AC-3
      - entry-id: IA-2
      - entry-id: PL-1
      - entry-id: PL-4
      - entry-id: PM-30
  - id: M-OSPS-GV-02-800-161
    relationship: relates-to
    source: OSPS-GV-02
    targets:
      - entry-id: AC-21
      - entry-id: AU-6
      - entry-id: PL-1
  - id: M-OSPS-GV-03-800-161
    relationship: relates-to
    source: OSPS-GV-03
    targets:
      - entry-id: AC-3
      - entry-id: AC-20
      - entry-id: PL-1
  - id: M-OSPS-GV-04-800-161
    relationship: relates-to
    source: OSPS-GV-04
    targets:
      - entry-id: AC-2
      - entry-id: AC-3
      - entry-id: AC-4(21)
      - entry-id: AC-5
      - entry-id: AC-6
      - entry-id: AC-20
      - entry-id: CM-7
      - entry-id: IR-4(6)
      - entry-id: PM-30
      - entry-id: SI-4
  - id: M-OSPS-LE-01-800-161
    relationship: relates-to
    source: OSPS-LE-01
    targets:
      - entry-id: PL-4
  - id: M-OSPS-LE-02-800-161
    relationship: relates-to
    source: OSPS-LE-02
    targets:
      - entry-id: PL-4
  - id: M-OSPS-LE-03-800-161
    relationship: relates-to
    source: OSPS-LE-03
    targets:
      - entry-id: PL-4
  - id: M-OSPS-QA-01-800-161
    relationship: relates-to
    source: OSPS-QA-01
    targets:
      - entry-id: RA-5
      - entry-id: SA-11
      - entry-id: SA-15
  - id: M-OSPS-QA-02-800-161
    relationship: relates-to
    source: OSPS-QA-02
    targets:
      - entry-id: CA-7
      - entry-id: CM-2
      - entry-id: CM-8
      - entry-id: PL-8
      - entry-id: RA-3(1)
      - entry-id: RA-5
      - entry-id: SA-11
      - entry-id: SA-15
      - entry-id: SR-3
      - entry-id: SR-4
  - id: M-OSPS-QA-03-800-161
    relationship: relates-to
    source: OSPS-QA-03
    targets:
      - entry-id: AU-6
      - entry-id: CM-3
      - entry-id: CM-6
      - entry-id: PL-8
      - entry-id: SA-11
      - entry-id: SA-15
      - entry-id: SR-3
  - id: M-OSPS-QA-04-800-161
    relationship: relates-to
    source: OSPS-QA-04
    targets:
      - entry-id: PL-8
      - entry-id: SA-15
  - id: M-OSPS-QA-05-800-161
    relationship: relates-to
    source: OSPS-QA-05
    targets:
      - entry-id: PL-8
      - entry-id: SA-15
      - entry-id: SR-3
  - id: M-OSPS-QA-06-800-161
    relationship: relates-to
    source: OSPS-QA-06
    targets:
      - entry-id: SA-11
      - entry-id: SA-15
      - entry-id: SR-3
  - id: M-OSPS-QA-07-800-161
    relationship: relates-to
    source: OSPS-QA-07
    targets:
      - entry-id: AC-5
      - entry-id: AU-6
      - entry-id: PL-8
      - entry-id: SA-15
      - entry-id: SR-3
  - id: M-OSPS-SA-01-800-161
    relationship: relates-to
    source: OSPS-SA-01
    targets:
      - entry-id: CM-2
      - entry-id: PL-8
      - entry-id: RA-3
      - entry-id: SA-15
  - id: M-OSPS-SA-02-800-161
    relationship: relates-to
    source: OSPS-SA-02
    targets:
      - entry-id: CM-2
      - entry-id: PL-2
      - entry-id: PL-8
      - entry-id: RA-3
      - entry-id: SA-15
  - id: M-OSPS-SA-03-800-161
    relationship: relates-to
    source: OSPS-SA-03
    targets:
      - entry-id: CA-2
      - entry-id: CA-2(3)
      - entry-id: PM-30
      - entry-id: RA-3
      - entry-id: SA-11
      - entry-id: SA-15
      - entry-id: SA-15(3)
      - entry-id: SA-15(8)
      - entry-id: SI-3
      - entry-id: SR-3
      - entry-id: SR-3(3)
      - entry-id: SR-6
      - entry-id: SR-7
  - id: M-OSPS-VM-01-800-161
    relationship: relates-to
    source: OSPS-VM-01
    targets:
      - entry-id: IR-1
      - entry-id: IR-4
      - entry-id: IR-6
      - entry-id: IR-7(1)
      - entry-id: IR-8
      - entry-id: SI-2
  - id: M-OSPS-VM-02-800-161
    relationship: relates-to
    source: OSPS-VM-02
    targets:
      - entry-id: IR-1
      - entry-id: IR-4
      - entry-id: IR-6
      - entry-id: IR-8
  - id: M-OSPS-VM-03-800-161
    relationship: relates-to
    source: OSPS-VM-03
    targets:
      - entry-id: IR-6
  - id: M-OSPS-VM-04-800-161
    relationship: relates-to
    source: OSPS-VM-04
    targets:
      - entry-id: CA-7
      - entry-id: CM-3
      - entry-id: CM-8
      - entry-id: IR-5
      - entry-id: SI-2
      - entry-id: SI-4
      - entry-id: SI-5
  - id: M-OSPS-VM-05-800-161
    relationship: relates-to
    source: OSPS-VM-05
    targets:
      - entry-id: CA-7
      - entry-id: RA-5
      - entry-id: SA-11
      - entry-id: SI-2
      - entry-id: SI-3
  - id: M-OSPS-VM-06-800-161
    relationship: relates-to
    source: OSPS-VM-06
    targets:
      - entry-id: CA-7
      - entry-id: RA-5
      - entry-id: SA-11
      - entry-id: SI-2
      - entry-id: SI-3
metadata:
  author:
    id: openssf
    name: OSPS Baseline Authors
    type: Human
  description: |
    Cross-walk from the Open Source Project Security (OSPS) Baseline
    controls to NIST SP 800-161. Each mapping asserts a "relates-to"
    relationship; strength, confidence-level, and rationale are left
    unset and should be added as the mappings are individually
    reviewed.
  draft: true
  gemara-version: 1.2.0
  id: osps-baseline-to-800-161
  mapping-references:
    - description: |
        The Open Source Project Security (OSPS) Baseline is a set of security
        criteria that projects should meet to demonstrate a strong security
        posture.
      id: osps-baseline
      title: Open Source Project Security Baseline
      url: https://github.com/ossf/security-baseline
      version: draft
    - description: This publication provides guidance to organizations on identifying,
        assessing, and mitigating cybersecurity risks throughout the supply
        chain at all levels of their organizations. The publication integrates
        cybersecurity supply chain risk management (C-SCRM) into risk management
        activities by applying a multilevel, C-SCRM-specific approach, including
        guidance on the development of C-SCRM strategy implementation plans,
        C-SCRM policies, C-SCRM plans, and risk assessments for products and
        services.
      id: 800-161
      title: NIST Special Publication 800-161 - Cybersecurity Supply Chain Risk
        Management Practices for Systems and Organizations
      url: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf
      version: r1-upd1
  type: MappingDocument
  version: v0.0.0-dev-671f23f
source-reference:
  entry-type: Control
  reference-id: osps-baseline
target-reference:
  entry-type: Guideline
  reference-id: 800-161
title: OSPS Baseline to NIST SP 800-161 Mapping