Simplifying Global Compliance for CNCF Projects With the OpenSSF OSPS Baseline
summary
OSPS Baseline releases a practical compliance stack: 40 requirements across three maturity levels covering access control, build and release, governance, documentation and vulnerability management and it maps to NIST SSDF, NIS2, DORA, CRA so one implementation satisfies multiple laws. It already produces machine readable signals and plans machine readable attestations plus tooling to automate evidence collection. Claims reduce downstream audit time, respond to a 44% year‑over‑year rise in public‑facing exploits and lower regulatory friction.
AI-written summary · about
chapters (9)
- 0:00OpenSSF OSPS Baseline intro
- 3:13Regulatory landscape in cybersecurity
- 10:27OSPS Baseline framework
- 13:17OSPS structure and maturity
- 16:12Global Cyber Policy collaboration
- 18:21Why OSPS Baseline matters
- 22:18Steps for maintainers and users
- 25:10Simplifying compliance with OSPS
- 27:18Future roadmap and closing
related talks
25mOSPS Baseline: Improving Your Project Security the Easy Way
29mTurn Down That Noise: Why the OpenSSF Security Baseline Is Good for Maintainers
48mApplying Cybersecurity Regulations and Industry Standards to Open Source Projects
29mWe're All Consumers (And That's Dandy)
46mOSS Management & OSPO Ask Anything
14mKeynote: All Your Base Are Belong to Us
30mContinuous Compliance in Open Source: Safety Assurance Through S...
30mFast, Lean, Precise, Controlled: Compliance Automation With OSCAL in Our Open-S...