OWASP SCVS

Software Component Verification Standard: inventory, identity, provenance, vulnerability disclosure.


Region	International
Country or scope	International
Sector	Application Security
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers OWASP SCVS

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 15 controls from Safeguard's control catalog for OWASP SCVS.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for OWASP SCVS and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SCVS-V1-INV` Complete Component Inventory	All direct and transitive components and their versions must be known and inventoried at all times (OWASP SCVS V1, Inventory control family)	Scan
`SCVS-V1-VER` Versions For All Components	The inventory must capture the version of every component so risk can be assessed per release (OWASP SCVS V1)	Scan
`SCVS-V2-FMT` Machine-Readable SBOM	SBOMs must be produced in a standardized, machine-readable format (e.g. CycloneDX or SPDX) with automation in the build pipeline (OWASP SCVS V2, SBOM control family)	Scan
`SCVS-V2-ID` Unique SBOM and Component Identity	SBOMs must have unique identifiers and timestamps, and components must be referenced by ecosystem-native identifiers such as PURL (OWASP SCVS V2)	Scan
`SCVS-V2-PURL` Standard Component Identifiers	Components in the SBOM must carry accurate, standard identifiers so they can be resolved and analyzed automatically (OWASP SCVS V2)	Scan
`SCVS-V5-VULN` Component Vulnerability Analysis	Components must be analyzed for known vulnerabilities, requiring identifiers that map to vulnerability databases (OWASP SCVS V5, Component Analysis control family)	Scan
`SCVS-V6-PROV` Pedigree and Provenance	The provenance of components: who supplied them and how the SBOM was produced, must be knowable and documented (OWASP SCVS V6, Pedigree and Provenance control family)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`SCVS-1.1`	Maintain a Complete Component Inventory
`SCVS-1.2`	Inventory Includes Transitive Dependencies
`SCVS-1.3`	Track Component Origins and Download Locations
`SCVS-1.4`	Identify and Remediate Unused Components
`SCVS-1.5`	Record Internal Components in Inventory
`SCVS-2.1`	Assign Package URLs (PURL) to Components
`SCVS-2.4`	Include CPE Identifiers Where Available
`SCVS-2.8`	Record Cryptographic Hashes for Components
`SCVS-3.1`	Continuously Monitor Components for Known Vulnerabilities
`SCVS-3.2`	Subscribe to Vulnerability Advisories for Critical Components
`SCVS-4.1`	Verify Component Authenticity via Signatures
`SCVS-4.3`	Document Component Acquisition Process
`SCVS-5.1`	Record Component Modification History (Pedigree)
`SCVS-6.1`	Identify and Track Open-Source License Obligations
`SCVS-6.2`	Automate License Compliance Scanning

Policy templates

Written for OWASP SCVS:

SBOM Management Policy (OWASP SCVS)
Open-Source Component Governance Policy

And 22 from the standard set, adapted to OWASP SCVS.