T/CECC 40-2025 Active Group standards

T/CECC 40-2025 Information security technology requirements for software supply chain open source component detection

Publish Date: 2025-06-30 Implement Date: 2025-06-30 For services related to genuine standard inquiry, procurement, translation, and other related services in China, please Contact Us

Price: $ 20.00

Out of stock

Basic Information

Standard Code: T/CECC 40-2025

Standard Type: Group standards

Standard Status: Active

is_force_gb: no

CCS Name: -

ICS Name: Comprehensive Application of Information Technology

Publish Date: 2025-06-30

Implement Date: 2025-06-30

Scope

Scope: This document specifies the management, processes, technical requirements, and tool requirements for the detection of open-source components in the software supply chain. This document is applicable to software vendors, buyers, and third parties conducting open-source component detection work in the software supply chain. Main technical content: 1. Management requirements for detection: (1) Detection organization (2) Management of components under test (3) Quality assurance (4) Process monitoring (5) Risk management (6) Review 2. Process requirements for detection: (1) Analysis and planning of detection requirements (2) Design and implementation of detection (3) Execution of detection (4) Summary of detection 3. Technical requirements for detection: (1) Component identification technology (2) Vulnerability detection technology (3) Software product license compliance detection (4) License compliance detection technology 4. Tool requirements for detection: (1) Version control capabilities (2) Dependency management capabilities (3) Source code component analysis capabilities (4) Binary component analysis capabilities (5) Reporting and visualization capabilities (6) Data management and privacy protection capabilities (7) Integration and extension capabilities (8) Performance and efficiency assurance capabilities