ISO/IEC 18974 — The Standard for Open Source Security

ISO/IEC 18974:2023 defines minimum requirements for an open source security assurance programme. It is not a law but a voluntary international standard. You should still know it: it describes in auditable form how a company runs open source security systematically — which is exactly what auditors and supervisory authorities ask about.

Why is a voluntary standard relevant? #

The EU cyber laws require systematic security measures:

DORA Art. 6(2) requires strategies, procedures and tools to protect information and ICT assets — which ones is left to you
NIS2 Art. 21(1) requires measures "taking into account the state of the art and, where applicable, relevant international standards"
CRA Recital 34 refers to due diligence measures when integrating open source components

ISO/IEC 18974 is the specialised standard for open source security. Whoever fulfils it produces structured, verifiable processes instead of merely asserting that their measures are appropriate. Whether those measures suffice in a given case still depends on your risk profile — but then you are arguing about your risk, not about your evidence.

What does ISO/IEC 18974 require? #

The requirements of the standard include:

Governance and organisation:

Written security assurance policy (4.1.1)
Defined competencies and roles (4.1.2)
Awareness of the policy, objectives and responsibilities (4.1.3)
Defined scope, metrics and regular review (4.1.4)
Sufficient staff, budget and expertise (4.2.2)

Detection and assessment:

Threat identification in the OSS supply chain (4.1.5 No. 1)
Method for detecting known vulnerabilities (4.1.5 No. 2)
Follow-up of identified vulnerabilities (4.1.5 No. 3)
Communication to customers (4.1.5 No. 4)
Post-release monitoring for new vulnerabilities (4.1.5 No. 5)
Continuous security testing before release (4.1.5 No. 6)
Risk verification before release (4.1.5 No. 7)
Risk export to third parties (4.1.5 No. 8)

Vulnerability management:

Public vulnerability channel (4.2.1)
SBOM creation and maintenance as a continuous process (4.3.1)
Vulnerability detection per component (4.3.2 No. 1)
Risk scoring per vulnerability (4.3.2 No. 2)
Documented remediation per vulnerability (4.3.2 No. 3)
Where required: coordinating remediation with customers (4.3.2 No. 4)
Risk-appropriate measures, including for new findings in software already shipped (4.3.2 Nos. 5 and 6)
Post-release monitoring for distributed software (4.3.2 No. 7)

SBOM requirements:

NTIA minimum elements: Supplier, Name, Version, other unique identifiers, Dependencies, Author of the SBOM data, Timestamp (3.1)

Conformity turns on the whole picture: every requirement must be met and evidenced, a selection is not enough (4.4.1). That is why isolated scans and individual measures do not carry far here.

Certification #

OpenChain conformity under ISO 18974 lasts 18 months from confirmation and is then renewed. The standard does not strictly require third-party certification — a self-attestation suffices. What matters either way is that you can evidence the implementation of every requirement. Those records are what you present to examiners and supervisory authorities.

How does OTTRIA cover ISO 18974? #

OTTRIA takes on the technical and operational part in full: vulnerability detection, SBOM evaluation, risk scoring, remediation, post-release monitoring, and communication. For the detection of known vulnerabilities (4.1.5 No. 2) we go beyond the standard: alongside registered CVEs we also detect Silent Fixes that appear in no public database.

The organisational requirements — written policy, competencies and roles, awareness, scope and resources — describe your own organisation and therefore stay in-house with you. We supply templates and advisory support for these, so you do not start that part from scratch.

What does this mean for you? #

Regardless of whether DORA, NIS2, or the CRA applies to you: an auditor will ask whether you meet the state of the art — and how you evidence it. An ISO-18974-compliant implementation answers that with a process chain that has been audited end to end. It does not replace any of the statutory obligations. But it shows, point by point, that you are meeting them systematically.