Potential New Work Item: Framework for Manufacturers #75
Description
One of the potential work items for our group that came out of our discussions on "security due diligence" in Ghent was a kind of framework for manufacturers. I envision that this would be a kind of document that would describe in general terms the kinds of processes and procedures that enterprises might adopt in order to better ensure compliance. For example, we could define security due diligence and make it clear when an enterprise might need to do this. This could reference other freely available guides (such as the concise guide to evaluating OSS or tools that might be used. This document could enable enterprise OSPOS or other similar organizations to have a shared vocabulary as well as a general idea of the kinds of processes they might need to incorporate.