Security Compliance Specification – ISO 18974 – OpenChain

This page describes the OpenChain Security Compliance standards and provides guidance on how to adopt them in companies with all sizes and sectors.
You can download the Security Compliance Specification directly from OpenChain Github (free version). see below:
You can also download the standards directly from the ISO website (paid version).
ISO/IEC 18974 is the International Standard for open source security assurance. ISO/IEC 18974 helps organizations check open source for known security vulnerability issues like CVEs, GitHub dependency alerts or package manager alerts.ISO/IEC 18974 is lightweight, easy to read and is supported by our global community with free reference material and conformance resources.
ISO/IEC 18974 identifies:
You can choose between self-certification (see the checklist below), independent assessment or third-party certification for either standard. Our recommendation is to start with self-certification and a narrowly-scoped program. We provide free short, simple checklists or questionnaires to do this with “yes” or “no” questions. If you can answer yes to everything in the forms below it means you are self-certified. If you answer no to a few questions, it means you can focus resources on key areas of process improvement.
Self Certification Checklist:
Third-Party Certification
Certification partner information: https://openchainproject.org/partners
If you would like to add your company to our list of conformant organisations, Please complete the online application form.
Till today, over 100+ companies have adopted OpenChain Standards, for more information, see here.
If you have any questions, please contact support@openchainproject.org.
We use CC-BY-4.0 for our specifications We use CC-0 for reference material We use The Linux Foundation anti-trust policy We use The Linux Foundation Events Code of Conduct
© 2026 OpenChain. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page. Linux is a registered trademark of Linus Torvalds. Privacy Policy and Terms of Use