OWASP/Software-Component-Verification-Standard

2.4-SCVS-BOM-04 - Should this be applicable to Level 2 as the tools aren't readily available.

Closed this issue · 2 comments

2.4-SCVS-BOM-04 - Should this be applicable to Level 2 as the tools aren't readily available.

My opinion on this is that Level 2 should not require particularly onerous efforts. It is beyond Level 1 of "I've heard of the problem", but not as far as "I'll build teams to create tooling where I cannot get it elsewhere".

If that's the perspective, then I think we should try to only include things in Level 2 that require implementing rather than developing solutions.

Tools area readily avaialble as the standards for doing so have been around for years.