Add BSI-TR-03185-2 reference IDs to OSPS-AC.yaml #461
Conversation
adding mappings for BSI Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
SecurityCRob
requested review from
eddie-knight,
evankanderson,
funnelfiasco and
puerco
| - reference-id: BSI-TR-03185-2 | ||
| entries: | ||
| - reference-id: GV.01 |
There was a problem hiding this comment.
BSI GV.01 states:
Information on how to contribute to the project MUST be documented.
Information about the expected quality of contributions SHOULD be
given.
This documentation requirement does not appear to be relevant to OSPS-AC-01, which pertains to mandatory enforcement of multi-factor authentication.
| - reference-id: Claim 2.2.2 | ||
| - reference-id: BSI-TR-03185-2 | ||
| entries: | ||
| - reference-id: QA.06 |
There was a problem hiding this comment.
BSI QA-06 states:
All changes to the source code SHOULD be peer-reviewed.
This seems more similar to OSPS-QA-07.01: "When a commit is made to the primary branch, the project's version control system MUST require at least one non-author human approval of the changes before merging."
I can see a loose mapping to branch protection, but it's pretty weak compared to QA-07. Do we want to keep multiple outgoing mappings?
adding mappings for BSI