Software Composition Analysis
What is Software Composition Analysis?
Tools and processes that identify open-source components in software and detect known vulnerabilities, licensing issues, and outdated dependencies.
Terms that appear alongside software composition analysis
Each of these is named in at least one of the same controls as software composition analysis. The number is how many controls name both.
- security testing 4 shared controls
- owasp 3 shared controls
- application security testing 3 shared controls
- application security 3 shared controls
- devsecops 2 shared controls
- software bill of materials 2 shared controls
- secure coding 2 shared controls
- supply chain security 2 shared controls
Frameworks that govern software composition analysis
What the standards actually require on software composition analysis
Requirements naming software composition analysis across 6 standards, quoted from the control text.
OSPS-VM-05 Publish and Enforce a Dependency Remediation Policy (maturity level 3). Requirement: The project documentation MUST include a policy to address SCA violations prior to any release.
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-05.02 · OSPS-VM-05.02 Publish and Enforce a Dependency Remediation Policy →All software artefacts are tested to detect known weaknesses using static application security testing (SAST), dynamic application security testing (DAST) or software composition analysis (SCA), depending on the software artefact type, before being imported in...
ISM-2028 · Testing software artefacts for known weaknesses →Maintain inventory of open source and third party components in code using Software Composition Analysis tools.
DS-2 · Ensure software supply chain security →A process shall be employed to perform vulnerability testing, including abuse case testing of interfaces, attack surface analysis, black box known vulnerability scanning, software composition analysis and dynamic runtime testing (fuzzing), on the product as de...
iec-62443::SVV-3 · Vulnerability testing →Security Layer 3 Applications per X.805 Clause 7.3: The Applications Security Layer covers what is required of the applications that service provider customers reach over the network.
X805-Layer3-Applications-Security-Email-Web-Directory-File-Transfer-E-Commerce-Video · ITU-T X.805 Security Layer 3 - Applications Security + Email + Web + Directory + File Transfer + E-Commerce + Video Conferencing + IM + Office Collaboration + SaaS + B2B EDI + Mobile Apps + APIs →Kuwait NCF Protect function (Infrastructure). Network Security and Segmentation: defense in depth + perimeter (firewall + WAF + DDoS mitigation) + internal segmentation (microsegmentation + VLAN + zero-trust network access ZTNA) + east-west traffic inspection...
KNCF-Protect-Network-Configuration-Vulnerability-Physical-Secure-SDLC-Hardening-Patching-Drift · Kuwait NCF Protect + Network + Configuration + Vulnerability + Physical + Secure SDLC →Questions people ask about software composition analysis
What is Software Composition Analysis?
Why is Software Composition Analysis important for compliance?
Which compliance frameworks address Software Composition Analysis?
Where can I learn more about Software Composition Analysis?
See how Software Composition Analysis applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.