SFS 7 / SF A

Back to SFS 7

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence been maintained for every production software release during the review period confirming that all third-party and open-source dependencies were reviewed for security vulnerabilities and license compliance?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Dependency review evidence exists for all releases

Assessment criterion and evidence

Actor: Organization responsible for software delivery. Scope: All production software systems under organizational control. Evidence period: Review period. Required evidence: Records of dependency scanning results; Documentation of license compliance assessments. Negative criterion: No evidence of dependency reviews found for releases. Missing evidence: Pending verification if evidence is incomplete or unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.