adammontville
commented
5 years ago Inputs:
- CI: Third-party component inventory (possibly from your automated build systems)
Operations:
- Enumerate all third-party components in the inventory
- For each component, verify:
- Latest component is being used
- The component is explicitly trusted by the organization
- Enumerate compliant components
- Enumerate non-compliant components
Measures:
- M1 = List of all third-party components being used
- M2 = List of all third-party components that are up-to-date and explicitly trusted
- M3 = List of all third-party components that are not up-to-date or not explicitly trusted
- M4 = |M1|
- M5 = |M2|
- M6 = |M3|
Metrics:
- M5 / M4 = Ratio of compliant third-party components to the total number of third-party components in use
Only use up-to-date and trusted third-party components for the software developed by the organization.
Measures
Metrics