The Open Source Security Foundation (OpenSSF), an organization dedicated to ensuring the security of open source software, announced the initial release of its Open Source Project Security Baseline (OSPS Baseline). The OSPS Baseline sets forth a framework of best practices for open source software developers and project maintainers:

The OSPS Baseline offers a tiered framework of security practices that evolve with project maturity. It compiles existing guidance from OpenSSF and other expert groups, outlining tasks, processes, artifacts, and configurations that enhance software development and consumption security. By adhering to the Baseline, developers can lay a foundation that supports compliance with global cybersecurity regulations, such as the EU Cyber Resilience Act (CRA) and U.S. National Institute of Standards and Technology (NIST) Secure Software Development Framework (SSDF).

The OSPS Baseline creates a new benchmark by which COSS companies can assess and promote their products.