International (OpenSSF)

Sigstore

17 controls. 116 other frameworks in our corpus share controls with it. Here is all of it, and how much of it you are already doing.

Page built . This page is derived from the framework corpus, which changes when the corpus is extended rather than daily.

17 controls 116 frameworks share controls with it International (OpenSSF) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you runShared controls
NIST SP 800-53 Rev 55measure it →
South Korea ISMS-P5measure it →
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)4measure it →
BSI IT-Grundschutz4measure it →
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.04measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)4measure it →
IEC 623514measure it →
ISO 134854measure it →
ISO 270174measure it →
ISO 270184measure it →
ISO 27799:20254measure it →
ISO/IEC 27011:20244measure it →

Every control

CodeControlAlso in
SIGSTORE-1Keyless Signing with Short-Lived Certificates0
SIGSTORE-2Transparency Log (Rekor) and Verification74
SIGSTORE-3Sigstore for Containers and Artifacts (Cosign)43
SIGSTORE-4Private Deployment, Long-Lived Migration, Regulated Environments0
SIGSTORE-COS-1Keyless Signing0
SIGSTORE-COS-2Key-Based Signing40
SIGSTORE-COS-3OCI Registry Storage0
SIGSTORE-COS-4Signature Verification0
SIGSTORE-FUL-1Short-Lived Certificate Issuance0
SIGSTORE-FUL-2Identity Binding0
SIGSTORE-FUL-3Certificate Transparency0
SIGSTORE-REK-1Signature Transparency Logging20
SIGSTORE-REK-2Tamper-Evident Storage0
SIGSTORE-REK-3RESTful API Validation0
SIGSTORE-VER-1Timestamp Verification0
SIGSTORE-VER-2Supply Chain Attestation44
SIGSTORE-VER-3Policy Enforcement0

Tell me when Sigstore files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

  • Retention schedule
  • Baseline version history
  • Change record archive
  • Rollback test evidence
  • Audit trail specification
  • Log retention policy

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

What this page is

A control-level reference for Sigstore, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition