OWASP CMS Fill Sheet — Project Page

Local working file. Not part of the repository (excluded in .gitignore).

CMS page: https://www.owasp.community/projects/open-source-intelligence-standard
CMS record id: 4c457b44-91ad-460e-a3c7-08201daea783
Created: 2026-07-26 by OWASP staff. No content has been authored yet.
Important: the CMS does not sync from GitHub. github_stars, contributors, and last_updated are null, so every field below must be filled by hand.

Sign in via the Sign in button in the top navigation using your @owasp.org address, then ask Starr on Slack for admin on this project page.

Fields already set by staff

Field	Value	Action
`title`	OWASP Open Source Intelligence Standard	Keep
`slug`	open-source-intelligence-standard	Keep
`category`	Documentation	Keep
`license`	CC BY-SA 4.0	Keep
`github_url`	`https://github.com/OWASP/OWASP-Open-Source-Intelligence-Standard/`	Keep
`project_type`	incubator	Keep — this is the current OWASP tier
`status`	active	Keep
`difficulty_level`	intermediate	Keep
`content_status`	draft	Change to published when the fields below are complete

Leadership

project_leaders currently lists Manish Tripathy only, which is correct. Leave as is until a co-leader is appointed through a public governance decision.

description

An open, vendor-neutral verification standard for traceable, reviewable, and rights-aware open-source intelligence.

long_description

The OWASP Open Source Intelligence Standard (OOSIS) builds testable assurance and interoperability resources for OSINT. Its normative core is the OWASP OSINT Verification Standard (OOVS), which defines requirements for assessing a defined OSINT workflow or intelligence product.

OOVS v0.1.0 publishes ten foundational requirements covering authorised purpose, collection boundaries, provenance, source and claim assessment, corroboration and confidence, analytic transparency, rights and safeguarding, AI assurance, dissemination, and governance. Each requirement ships with evidence expectations, an assessment procedure, pass criteria, and an acceptance test, plus machine-readable schemas so teams and tool builders can adopt it directly.

version

0.1.0

documentation_url

https://github.com/OWASP/OWASP-Open-Source-Intelligence-Standard/blob/main/oovs/v0.1/standard.md

project_url and website_url

https://github.com/OWASP/OWASP-Open-Source-Intelligence-Standard

downloads

https://github.com/OWASP/OWASP-Open-Source-Intelligence-Standard/releases/tag/v0.1.0

features / key_features

Ten testable L1 requirements with objectives, evidence, procedures, and pass criteria
Two assessment targets: a defined workflow or a defined intelligence product
Machine-readable requirement catalogue and JSON Schema
Ten acceptance tests, one per requirement
Portable assessment-result schema with a worked synthetic example
Source-origin checks so repeated reporting is not mistaken for independent corroboration
Rights-aware controls for purpose, minimisation, safeguarding, AI accountability, and correction
Conservative mappings to established public guidance
Automated validation in CI: schemas, semantics, parity, fixtures, links, and release hashes

requirements

Reading and applying the standard requires no tooling. To run the repository validation locally: Python 3.10 or newer and jsonschema==4.25.1 (pip install -r requirements-validation.txt).

getting_started

Read the standard at oovs/v0.1/standard.md.
Define your assessment target: a workflow or an intelligence product, with scope, exclusions, period, sample, and whether high-consequence use applies.
Assess each of the ten requirements as Implemented, Partially implemented, Not implemented, or Not applicable, with controlled evidence references.
Validate your result against oovs/v0.1/assessment.schema.json and compare with the worked example.
Publish scope, method, aggregate results, and limitations, distinguishing self-assessment from independent assessment.
Send feedback through the repository issue templates, without personal, live-case, victim, credential, or operationally sensitive data.

project_overview / tab_overview_content

OSINT products increasingly drive consequential decisions, but the reasoning behind them is often difficult to review. OOVS makes five questions assessable for a defined workflow or product:

Purpose — is the work authorised, necessary, proportionate, and bounded?
Evidence — can material claims be traced to observations, transformations, and independent origins?
Analysis — are facts, inference, assumptions, alternatives, and uncertainty distinguishable?
Action — is dissemination controlled, caveated, correctable, and tied to an intended decision?
Governance — are accountable people, challenge, audit, safety, and improvement operating in practice?

The baseline is consequence-sensitive: verification depth and safeguards scale with the impact of an error rather than with a job title.

Scope boundaries. OOVS is a voluntary standard. It is not a certification or accreditation scheme, does not determine legal compliance or evidentiary admissibility, and does not imply endorsement by any government, agency, court, or vendor. It complements applicable law, professional training, and existing work such as the Berkeley Protocol, ICD 203/206, W3C PROV, STIX/TAXII, and CASE/UCO, and it is a standard rather than an intelligence platform.

tab_documentation_content

Standard: oovs/v0.1/standard.md
Machine-readable requirements: oovs/v0.1/requirements.json
Requirement schema: oovs/v0.1/requirements.schema.json
Acceptance tests: oovs/v0.1/tests.json
Assessment-result schema: oovs/v0.1/assessment.schema.json
Worked synthetic assessment: oovs/v0.1/examples/synthetic-assessment.json
External mappings: oovs/v0.1/mappings.md
Prior art and positioning: docs/prior-art-and-positioning.md
Safety, rights, and misuse policy: docs/safety-rights-and-misuse-policy.md
Governance: GOVERNANCE.md · Release policy: programme/RELEASE_POLICY.md

tab_downloads_content

OOVS v0.1.0 — released 2026-08-05, tag v0.1.0.

The release manifest records canonical files with SHA-256 hashes. Verify locally:

python3 -m pip install -r requirements-validation.txt
python3 scripts/validate_assets.py

tab_community_content

Useful contributions right now:

Assess a workflow or product against OOVS and share aggregate results
Report requirement wording that produced inconsistent assessments
Contribute technique records, testing scenarios, mappings, or translations
Help build the synthetic cyber-exposure and CTI reference slice
Review safety, privacy, human-rights, accessibility, or jurisdictional considerations

Do not submit personal data, live-case material, victim information, target lists, credentials, or operationally sensitive content through public channels. Use synthetic, consented, anonymised, or non-sensitive examples.

tab_contribute_content

See CONTRIBUTING.md and GOVERNANCE.md. Reviewer and maintainer roles are open and listed in MAINTAINERS.md: requirement and testability, safety and rights, schema and validation, release management, accessibility, and translation or regional coordination. Reviewers from different organisations, regions, and legal contexts are especially welcome.

tab_support_content

Open an issue in the repository. Security and safety concerns follow SECURITY.md. Conduct concerns follow the OWASP reporting path in CODE_OF_CONDUCT.md.

roadmap

Delivered — v0.1.0. L1 baseline, machine-readable requirements, acceptance tests, assessment schema, worked example, mappings, governance, and CI validation.

Next. Assessor and sampling guidance, an assessment report template, implementation feedback from synthetic material, and measured consistency between independent assessors.

Then. Twelve reviewed technique records, six testing scenarios, a minimal graph profile with published gap analysis against W3C PROV and CASE/UCO, and one reproducible synthetic cyber-exposure and CTI slice with an implementation report.

Later. Additional assurance depth based on evidence, clause-level external crosswalks, public-sector adoption resources, and a Top Ten edition produced through a published methodology.

changelog / release_notes

Summarise CHANGELOG.md and link the GitHub release. Keep the version and date visible.

community_guidelines

Follows the OWASP Code of Conduct. Public collaboration uses synthetic, consented, anonymised, or non-sensitive material. Material concerning minors or vulnerable people must never be posted in public project channels.

security_considerations

The project publishes no live data and hosts no operational service. Contributions must exclude personal data, case material, credentials, and target information. High-risk topics receive safety and rights review before publication. See docs/safety-rights-and-misuse-policy.md.

compliance_standards

Use with care. Populate this field only as related public guidance, informatively mapped — never as a compliance claim:

Informative mappings to the Berkeley Protocol, ICD 203, ICD 206, W3C PROV, NIST AI RMF, STIX/TAXII, and FIRST TLP. These indicate relevance, not equivalence, certification, or legal compliance.

meta_title

OWASP Open Source Intelligence Standard | OOVS

meta_description

OOVS is an open standard for assessing the provenance, verification, safety, AI use, dissemination, and governance of OSINT workflows and intelligence products.

meta_keywords

OSINT, verification standard, provenance, intelligence analysis, assurance, AI risk, open standards, OWASP

Navigation Menu

Repository navigation

OOVS v0.1.0

Choose a tag to compare

Sorry, something went wrong.