SFS 8 / SF 5

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all third-party and open-source software dependencies reviewed for security vulnerabilities and license compliance before integration into development throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: documented evidence confirms all dependencies underwent security and license compliance review prior to integration

Assessment criterion and evidence

Actor: organization development teams. Scope: software development lifecycle dependency management. Evidence period: throughout the review period. Required evidence: dependency review policies; vulnerability scan reports; license compliance verification records. Negative criterion: evidence shows unreviewed dependencies were integrated or review processes were inconsistent. Missing evidence: pending until documented dependency review records become available

View the JSON record (opens in a new tab).

Assessment result: unset.