grc.store

Search / openssf/osps-baseline-to-psscrm / v0.0.0-dev-671f23f

Release · v0.0.0-dev-671f23f

openssf/osps-baseline-to-psscrm Mapping Document

openssf/osps-baseline-to-psscrm

Cross-walk from the Open Source Project Security (OSPS) Baseline controls to P-SSCRM. Each mapping asserts a "relates-to" relationship; strength, confidence-level, and rationale are left unset and should be added as the mappings are individually reviewed.

Published by OSPS Baseline Authors

License No license declared

Install

OCI v1.1
$grcli unpack --repository openssf/osps-baseline-to-psscrm --version v0.0.0-dev-671f23f

grcli unpack verifies this signature against the recorded identity below and fails closed before writing any files — no separate verify step needed. Pass --no-verify to skip.

Coordinate
oci.grc.store/openssf/osps-baseline-to-psscrm:v0.0.0-dev-671f23f
Manifest digest
sha256:206888845a1006d9451316dcda02b86459950cddd916b488496b8f1370879bc6
Signed by
no signature recorded

Identity recorded by this hub when the version was published; unpack (above) checks the signature against it.

Verify in CI — check the signature without downloading
$grcli verify --repository openssf/osps-baseline-to-psscrm --version v0.0.0-dev-671f23f

Read-only: downloads nothing and exits non-zero if the signature or the recorded identity doesn't match — use it as an admission/policy gate.

Provenance

1 layer
Digest Media type Size
ff1d1dd3c410… application/vnd.gemara.artifact.v1+yaml 8.0 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "1.2.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "osps-baseline-to-psscrm",
            "type": "MappingDocument"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "openssf/osps-baseline-to-psscrm",
            "tag": "v0.0.0-dev-671f23f"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/security-baseline",
          "GITHUB_RUN_ATTEMPT": "1",
          "GITHUB_RUN_ID": "26617016306",
          "GITHUB_SHA": "671f23f015e4b0f6108ab8f82f0eba7f89d55dce",
          "GITHUB_WORKFLOW": "Publish to grc.store",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "/home/runner/work/_temp/staged/osps-to-psscrm.yaml",
            "uri": "file:///home/runner/work/_temp/staged/osps-to-psscrm.yaml",
            "digest": {
              "sha256": "ff1d1dd3c41062b71e116825f8c16f2dcf7edd60f6cb6ac30df39051e72a3232"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/security-baseline@671f23f015e4b0f6108ab8f82f0eba7f89d55dce",
            "digest": {
              "gitCommit": "671f23f015e4b0f6108ab8f82f0eba7f89d55dce"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/security-baseline/actions/runs/26617016306",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.2.2"
          }
        },
        "metadata": {
          "invocationId": "26617016306-1",
          "startedOn": "2026-05-29T03:57:20.009120217Z",
          "finishedOn": "2026-05-29T03:57:20.092519421Z"
        },
        "byproducts": [
          {
            "name": "osps-to-psscrm.yaml",
            "digest": {
              "sha256": "ff1d1dd3c41062b71e116825f8c16f2dcf7edd60f6cb6ac30df39051e72a3232"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "osps-to-psscrm.yaml",
      "type": "MappingDocument",
      "id": "osps-baseline-to-psscrm",
      "role": "artifact"
    }
  ]
}

No rich preview yet

This UI can't render MappingDocument artifacts richly yet. The raw content is shown below, and the artifact stays pullable via the coordinate above.

mappings:
  - id: M-OSPS-AC-01-PSSCRM
    relationship: relates-to
    source: OSPS-AC-01
    targets:
      - entry-id: G2.6
      - entry-id: P3.3
      - entry-id: E1.2
      - entry-id: E1.3
      - entry-id: E1.4
      - entry-id: E3.1
  - id: M-OSPS-AC-02-PSSCRM
    relationship: relates-to
    source: OSPS-AC-02
    targets:
      - entry-id: P2.3
      - entry-id: E1.2
      - entry-id: E3.3
  - id: M-OSPS-AC-03-PSSCRM
    relationship: relates-to
    source: OSPS-AC-03
    targets:
      - entry-id: P3.2
      - entry-id: P3.5
      - entry-id: E1.5
      - entry-id: E3.1
  - id: M-OSPS-AC-04-PSSCRM
    relationship: relates-to
    source: OSPS-AC-04
    targets:
      - entry-id: P3.2
  - id: M-OSPS-BR-01-PSSCRM
    relationship: relates-to
    source: OSPS-BR-01
    targets:
      - entry-id: P2.3
      - entry-id: P3.2
      - entry-id: P3.5
      - entry-id: E2.4
      - entry-id: E2.5
      - entry-id: D2.2
  - id: M-OSPS-BR-02-PSSCRM
    relationship: relates-to
    source: OSPS-BR-02
    targets:
      - entry-id: G1.4
      - entry-id: E1.2
      - entry-id: E2.1
      - entry-id: E2.6
  - id: M-OSPS-BR-03-PSSCRM
    relationship: relates-to
    source: OSPS-BR-03
    targets:
      - entry-id: E1.1
      - entry-id: E2.2
      - entry-id: E2.4
      - entry-id: E2.5
  - id: M-OSPS-BR-04-PSSCRM
    relationship: relates-to
    source: OSPS-BR-04
    targets:
      - entry-id: G1.4
      - entry-id: E2.1
      - entry-id: E2.4
      - entry-id: E2.5
      - entry-id: E3.1
      - entry-id: E3.6
  - id: M-OSPS-BR-05-PSSCRM
    relationship: relates-to
    source: OSPS-BR-05
    targets:
      - entry-id: P3.1
      - entry-id: P3.5
      - entry-id: E2.2
      - entry-id: E2.3
      - entry-id: E2.4
      - entry-id: E2.5
  - id: M-OSPS-BR-06-PSSCRM
    relationship: relates-to
    source: OSPS-BR-06
    targets:
      - entry-id: P1.2
      - entry-id: P3.2
      - entry-id: P3.3
      - entry-id: E2.1
      - entry-id: E2.2
      - entry-id: E2.6
  - id: M-OSPS-DO-01-PSSCRM
    relationship: relates-to
    source: OSPS-DO-01
    targets:
      - entry-id: G5.1
      - entry-id: E3.5
  - id: M-OSPS-DO-03-PSSCRM
    relationship: relates-to
    source: OSPS-DO-03
    targets:
      - entry-id: G1.3
      - entry-id: G2.5
      - entry-id: P1.2
      - entry-id: P3.1
      - entry-id: P3.2
      - entry-id: P3.3
      - entry-id: E2.6
  - id: M-OSPS-DO-04-PSSCRM
    relationship: relates-to
    source: OSPS-DO-04
    targets:
      - entry-id: E1.6
  - id: M-OSPS-DO-05-PSSCRM
    relationship: relates-to
    source: OSPS-DO-05
    targets:
      - entry-id: E1.6
  - id: M-OSPS-DO-06-PSSCRM
    relationship: relates-to
    source: OSPS-DO-06
    targets:
      - entry-id: G1.4
      - entry-id: G2.4
      - entry-id: P3.1
      - entry-id: P3.2
      - entry-id: P3.4
  - id: M-OSPS-GV-01-PSSCRM
    relationship: relates-to
    source: OSPS-GV-01
    targets:
      - entry-id: G2.3
      - entry-id: E3.1
      - entry-id: E3.3
  - id: M-OSPS-GV-03-PSSCRM
    relationship: relates-to
    source: OSPS-GV-03
    targets:
      - entry-id: G2.4
      - entry-id: P2.2
  - id: M-OSPS-GV-04-PSSCRM
    relationship: relates-to
    source: OSPS-GV-04
    targets:
      - entry-id: E3.1
      - entry-id: E3.3
  - id: M-OSPS-LE-01-PSSCRM
    relationship: relates-to
    source: OSPS-LE-01
    targets:
      - entry-id: E3.1
  - id: M-OSPS-LE-02-PSSCRM
    relationship: relates-to
    source: OSPS-LE-02
    targets:
      - entry-id: G1.2
  - id: M-OSPS-LE-03-PSSCRM
    relationship: relates-to
    source: OSPS-LE-03
    targets:
      - entry-id: G1.2
  - id: M-OSPS-QA-01-PSSCRM
    relationship: relates-to
    source: OSPS-QA-01
    targets:
      - entry-id: P3.5
      - entry-id: E2.2
  - id: M-OSPS-QA-02-PSSCRM
    relationship: relates-to
    source: OSPS-QA-02
    targets:
      - entry-id: G1.4
      - entry-id: G1.5
      - entry-id: G2.5
      - entry-id: P3.1
      - entry-id: P3.2
      - entry-id: P5.1
      - entry-id: P5.2
      - entry-id: E2.1
      - entry-id: E2.2
  - id: M-OSPS-QA-03-PSSCRM
    relationship: relates-to
    source: OSPS-QA-03
    targets:
      - entry-id: G2.2
      - entry-id: G5.3
      - entry-id: G5.4
      - entry-id: P3.5
      - entry-id: P4.1
      - entry-id: P4.2
  - id: M-OSPS-QA-04-PSSCRM
    relationship: relates-to
    source: OSPS-QA-04
    targets:
      - entry-id: G2.2
      - entry-id: G5.4
  - id: M-OSPS-QA-06-PSSCRM
    relationship: relates-to
    source: OSPS-QA-06
    targets:
      - entry-id: P4.1
      - entry-id: P4.2
      - entry-id: P4.3
      - entry-id: P4.4
      - entry-id: E2.4
      - entry-id: E2.5
  - id: M-OSPS-QA-07-PSSCRM
    relationship: relates-to
    source: OSPS-QA-07
    targets:
      - entry-id: G2.4
      - entry-id: P3.3
      - entry-id: P3.5
  - id: M-OSPS-SA-01-PSSCRM
    relationship: relates-to
    source: OSPS-SA-01
    targets:
      - entry-id: G5.1
      - entry-id: P1.1
      - entry-id: E3.4
      - entry-id: E3.7
  - id: M-OSPS-SA-02-PSSCRM
    relationship: relates-to
    source: OSPS-SA-02
    targets:
      - entry-id: E3.4
      - entry-id: E3.7
  - id: M-OSPS-SA-03-PSSCRM
    relationship: relates-to
    source: OSPS-SA-03
    targets:
      - entry-id: G4.3
      - entry-id: G5.2
      - entry-id: P2.1
  - id: M-OSPS-VM-01-PSSCRM
    relationship: relates-to
    source: OSPS-VM-01
    targets:
      - entry-id: D1.1
      - entry-id: D1.2
      - entry-id: D1.3
      - entry-id: D1.5
  - id: M-OSPS-VM-04-PSSCRM
    relationship: relates-to
    source: OSPS-VM-04
    targets:
      - entry-id: G2.2
      - entry-id: D1.1
  - id: M-OSPS-VM-05-PSSCRM
    relationship: relates-to
    source: OSPS-VM-05
    targets:
      - entry-id: G5.4
      - entry-id: P4.1
      - entry-id: P4.2
      - entry-id: P4.3
      - entry-id: P4.4
      - entry-id: P4.5
  - id: M-OSPS-VM-06-PSSCRM
    relationship: relates-to
    source: OSPS-VM-06
    targets:
      - entry-id: G5.4
      - entry-id: P4.1
      - entry-id: P4.2
      - entry-id: P4.3
      - entry-id: P4.4
      - entry-id: P4.5
metadata:
  author:
    id: openssf
    name: OSPS Baseline Authors
    type: Human
  description: |
    Cross-walk from the Open Source Project Security (OSPS) Baseline
    controls to P-SSCRM. Each mapping asserts a "relates-to"
    relationship; strength, confidence-level, and rationale are left
    unset and should be added as the mappings are individually
    reviewed.
  draft: true
  gemara-version: 1.2.0
  id: osps-baseline-to-psscrm
  mapping-references:
    - description: |
        The Open Source Project Security (OSPS) Baseline is a set of security
        criteria that projects should meet to demonstrate a strong security
        posture.
      id: osps-baseline
      title: Open Source Project Security Baseline
      url: https://github.com/ossf/security-baseline
      version: draft
    - description: The Proactive-Software Supply Chain Risk Management (P-SSCRM)
        Framework is designed to help you understand and plan a secure software
        supply chain risk management initiative. P-SSCRM was created through a
        process of understanding and analyzing real-world data from nine
        industry-leading software supply chain risk management initiatives as
        well as through the analysis and unification of ten government and
        industry documents, frameworks, and standards. Although individual
        methodologies and standards differ, many initiatives and standards share
        common ground. P-SSCRM describes this common ground and presents a model
        for understanding, quantifying, and developing a secure software supply
        chain risk management program and determining where your organization’s
        existing efforts stand when contrasted with other real-world software
        supply chain risk management initiatives.
      id: PSSCRM
      title: Proactive Software Supply Chain Risk Management Framework
      url: https://arxiv.org/pdf/2404.12300
      version: "1.0"
  type: MappingDocument
  version: v0.0.0-dev-671f23f
source-reference:
  entry-type: Control
  reference-id: osps-baseline
target-reference:
  entry-type: Guideline
  reference-id: PSSCRM
title: OSPS Baseline to P-SSCRM Mapping