O-TTPS / ISO 20243

Open Trusted Technology Provider Standard: secure engineering, supply chain risk, license compliance.


Short name	O-TTPS
Region	International
Country or scope	International
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers O-TTPS

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 6 controls from Safeguard's control catalog for O-TTPS.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for O-TTPS and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`OTTPS-SC-INV` Product Component Traceability	Providers must be able to trace the components incorporated into their products through the supply chain, starting with a complete inventory of included components (ISO/IEC 20243-1 supply chain security requirements)	Scan
`OTTPS-SC-CTM` Counterfeit Mitigation via Component Identity	To mitigate counterfeit components, each component must be precisely identified with a standard identifier so genuine parts can be distinguished from substitutes (ISO/IEC 20243-1 counterfeit mitigation requirements)	Scan
`OTTPS-SC-TAINT` Tainted Product Mitigation via Integrity	To mitigate maliciously tainted components, delivered software must be verifiable against cryptographic integrity data (ISO/IEC 20243-1 malware/taint mitigation requirements)	Scan
`OTTPS-SC-SUP` Supplier Management	Providers must apply supply chain security requirements to their suppliers, which presupposes that the supplier of each third-party component is known and recorded (ISO/IEC 20243-1 supplier management requirements)	Scan
`OTTPS-SE-LIC` Intellectual Property and License Compliance	Secure engineering practice includes managing the intellectual property rights of incorporated third-party and open source components, requiring license information per component (ISO/IEC 20243-1 secure engineering / IP management requirements)	Scan
`OTTPS-SE-CM` Configuration and Version Control	Well-defined development discipline requires configuration management of product components, meaning each component's version is tracked (ISO/IEC 20243-1 product development / engineering method requirements)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`OTTPS-PD-DES`	Apply Security in Product Design
`OTTPS-PD-CFM`	Implement Configuration and Change Management
`OTTPS-PD-SCEM`	Control Software Component and External Modules
`OTTPS-SC-RSM`	Assess and Manage Supply Chain Risk
`OTTPS-SC-DIST`	Secure Product Distribution and Delivery
`OTTPS-SC-PROC`	Vet and Monitor Critical Suppliers

Policy templates

Written for O-TTPS:

Product Security and Supply Chain Risk Management Policy (O-TTPS)

And 22 from the standard set, adapted to O-TTPS.