Managing risks with OSS

For third-party-developed software, since an organization is dealing with a specific vendor, following an approach using the previously discussed RASIC, vendor security assessment, and CIAD is possible.

However, for OSS, an organization needs to handle this differently, since the organization is not typically dealing with a specific vendor that is developing the OSS component. Instead, the OSS component is developed and maintained by the community.

Although it would be possible to define a RASIC to clarify the responsibilities of the organization, it would not be beneficial to expect that the OSS project or the contributing individuals would perform the cybersecurity activities that the RASIC may indicate. As such, the RASIC may be used more to indicate any gaps in cybersecurity activities or to indicate what the organization will do.

Moreover, it would not be possible to establish a CIAD with the individual contributors to the OSS project, since most...