...
There are 3 levels of CII badging:
|
|
|
For ONAP, 4 levels of compliance have been defined:
...
Level | Example Details/Criteria |
Passing | The project website MUST succinctly describe what the software does (what problem does it solve?). |
Silver | The project MUST document what the user can and cannot expect in terms of security from the software produced The assurance case MUST include: a description of the threat model, clear identification of trust boundaries, and evidence that common security weaknesses have been |
Gold | The project MUST have at least 50% of all proposed modifications reviewed before release by a person other than |
Badge Specific Adherence requirements
Each of the Badging level is associated with compliance requirements which in turn may vary from being e.g. absolute to being as varied as recommendatory in nature.
The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT", and "MAY" in the Badging guideline documents are to be interpreted as described in RFC 2119.
- The term MUST is an absolute requirement, and MUST NOT is an absolute prohibition.
- The term SHOULD indicates a criterion that is normally required, but there may exist valid reasons in particular circumstances to ignore it. However, the full implications must be understood and carefully weighed before choosing a different course.
- The term SUGGESTED is used instead of SHOULD when the criterion must be considered, but valid reasons to not do so are even more common than for SHOULD.
- Often a criterion is stated as something that SHOULD be done, or is SUGGESTED, because it may be difficult to implement or the costs to do so may be high.
- The term MAY provides one way something can be done, e.g., to make it clear that the described implementation is acceptable.
- To obtain a badge, all MUST and MUST NOT criteria must be met, all SHOULD criteria must be met OR the rationale for not implementing the criterion must be documented, and all SUGGESTED criteria have to be considered (rated as met or unmet). In some cases a URL may be required as part of the criterion's justification.
R2 Beijing Requirements
For the Beijing release, the compliance requirement is Level 1 (at least 70% of the project are on passing level, and all non-passing projects at >80% towards passing).
...