<!-- Completed by AEOESS for the Agent Passport System project, 2026-07-10.
Every statement verified against docs/OPEN-SOURCE-POLICY.md,
docs/SECURITY-ASSURANCE-PROGRAM.md, SECURITY.md, and repository controls.
Source checklist: OpenChain Reference-Material (CC0). Standard: ISO/IEC 18974:2023. -->

![](./media/image1.png "OpenChain logo")

# OpenChain ISO/IEC 18974 Self-Certification Checklist

## The Simple Way To Check Conformance

Generation 2 - Version 1
2025-08-18

# Introduction

OpenChain ISO/IEC 18974 is the International Standard for open source security assurance. ISO/IEC 18974 helps organizations check open source for known security vulnerability issues like CVEs, GitHub dependency alerts or package manager alerts.

Your organization can self-certify to conform to OpenChain ISO/IEC 18974. It is as simple as answering “yes” to all the questions on the online form. If an organization cannot answer “yes” to all of the questions, it does not yet meet the requirements of the standard.

Please note that this is a self-certification, and you and your organization are solely responsible for the accuracy of the statements below.

You also have the option of filling out this checklist online:
[https://openchainproject.org/checklist-iso-18974-2023](https://openchainproject.org/checklist-iso-18974-2023)

# The Self-Certification Checklist

## Section 4.1.1

- [x] We have a documented policy governing the open source security assurance of Supplied Software.

- [x] We have a documented procedure to communicate the existence of the open source policy to all Program Participants.

## Section 4.1.2

- [x] We have identified the roles and responsibilities that affect the performance and effectiveness of the Program.

- [x] We have identified and documented the competencies required for each role.

- [x] We have identified and documented a list of Program Participants and how they fill their respective roles.

- [x] We have documented the assessed competence for each Program Participant.

- [x] We have a way to document periodic reviews and changes made to our processes.

- [x] We have a way to verify that our processes align with current company best practices and staff assignments.

## Section 4.1.3

- [x] Our Program Participants are aware of the open source security assurance policy and where to find it.

- [x] Our Program Participants are aware of relevant open source objectives.

- [x] Our Program Participants are aware of contributions expected to ensure the effectiveness of the Program.

- [x] Our Program Participants are aware of the implications of failing to follow the Program requirements.

## Section 4.1.4

- [x] We have a written statement clearly defining the scope and limits of the Program.

- [x] We have a set of metrics to measure Program performance.

- [x] We have Documented Evidence from each review, update, or audit to demonstrate continuous improvement.

## Section 4.1.5

- [x] We have a method to identify structural and technical threats to the Supplied Software.

- [x] We have a method for detecting existence of Known Vulnerabilities in Supplied Software.

- [x] We have a method for following up on identified Known Vulnerabilities.

- [x] We have a method to communicate identified Known Vulnerabilities to customer base when warranted.

- [x] We have a method for analyzing Supplied Software for newly published Known Vulnerabilities post release of the Supplied Software.

- [x] We have a method for continuous and repeated Security Testing is applied for all Supplied Software before release.

- [x] We have a method to verify that identified risks will have been addressed before release of Supplied Software.

- [x] We have a method to export information about identified risks to third parties as appropriate.

## Section 4.2.1

- [x] We have a method to allow third parties to make Known Vulnerability or Newly Discovered Vulnerability enquires (e.g., via an email address or web portal that is monitored by Program Participants).

- [x] We have an internal documented procedure for responding to third party Known Vulnerability or Newly Discovered Vulnerability inquiries.

## Section 4.2.2

- [x] We have documented the people, group or functions related to the Program.

- [x] We have ensured the identified Program roles have been properly staffed and adequate funding has been provided.

- [x] We have ensured expertise available is to address identified Known Vulnerabilities.

- [x] We have a documented procedure that assigns internal responsibilities for Security Assurance.

## Section 4.3.1

- [x] We have a documented procedure ensuring all Open Source Software used in the Supplied Software is continuously recorded across the lifecycle of the Supplied Software. This includes an archive of all Open Source Software used in the Supplied Software.

- [x] We have open source component records for the Supplied Software which demonstrate the documented procedure was properly followed.

## Section 4.3.2

- [x] We have a documented procedure for handling detection and resolution of Known Vulnerabilities for the Open Source Software components of the Supplied Software.

- [x] We have open source component records for the Supplied Software which track identified Known Vulnerabilities and action(s) taken (including even if no action was required).

## Section 4.4.1

- [x] We have documentation confirming that the Program meets all the requirements of this specification.

## Section 4.4.2

- [x] We have documentation confirming that Program conformance was reviewed within the last 18 months.

# Next Steps

Have you self-certified to this specification? You can let us know at this link:
[https://openchainproject.org/conformance-submission](https://openchainproject.org/conformance-submission)

We would love to add your organization to our Community of Conformance list on the OpenChain Project website. This is optional, but it is a great way to encourage adoption across the supply chain.
