Establish and document a cybersecurity policy for open-source software

As an OSS steward, you must have a written cybersecurity policy that covers how your project develops secure software and how it handles security vulnerabilities when they are discovered. This does not need to be a corporate-style compliance document — it can be a SECURITY.md file, a project security policy, or similar — but it must exist and be documented. The policy must address both secure development practices and vulnerability handling.

Legal text

Article 24(1) of Regulation (EU) 2024/2847 provides that open-source software stewards shall put in place and document a cybersecurity policy to foster the development of a secure product with digital elements, including the open-source software components they provide, and to handle vulnerabilities in an effective manner in accordance with Article 13(6) as it applies to them.

The cybersecurity policy shall address, at minimum:

the secure development practices applied to the open-source software;
the vulnerability handling process, including coordinated disclosure.

Key requirements

Written policy — must be documented (not merely an informal practice)
Secure development coverage — policy addresses how security is considered during development of the OSS component
Vulnerability handling — policy covers how vulnerabilities are received, triaged, addressed, and disclosed
Coordinated disclosure process — clear process for security researchers and users to report vulnerabilities (e.g. SECURITY.md, vulnerability disclosure policy)
Kept up to date — policy should evolve as the project and threat landscape change

Evidence you may need

Published security policy document (e.g. SECURITY.md in source repository)
Vulnerability disclosure policy or coordinated disclosure process document
Secure development guidelines referenced or applied by the project
Evidence that the policy is actively followed (e.g. closed CVEs via disclosure process)