Update Security Management process by sunildevda · Pull Request #542 · eclipse-score/process_description

sunildevda · 2026-01-30T07:21:13Z

Changes as mentioned in #451

github-actions · 2026-01-30T07:23:47Z

The created documentation from the pull request is available at: docu-html

pahmann

Initial review finding. More findings may come in following review

process/folder_templates/modules/module_name/docs/manual/security_manual.rst

PandaeDo

Please fix build errors

process/folder_templates/modules/module_name/docs/manual/security_manual.rst

process/folder_templates/platform/security_analysis/platform_security_manual.rst

process/folder_templates/platform/security_analysis/platform_security_package_fdr.rst

process/process_areas/security_management/security_management_getstrt.rst

PandaeDo · 2026-01-30T09:08:10Z

process/process_areas/security_management/security_management_roles.rst

-   * Creates and monitors the completeness of the security package
-   * Creates and maintains the Security Manual
-   * Supports creation and maintaining of the SBOM
+   * Creates and maintains following Security artifcats at platform level: Platform Security Plan, Platform Security package, Platform Security Manual, Platform SBOM


Please check against https://eclipse-score.github.io/process_description/main/process_areas/security_management/security_management_workflow.html. You can use the table at the end of the page. Also it might be a idea to link to here. This would be easier to maintain

But if we do that, we should do it also for Safety Manager to be consistent, or not?

@PandaeDo i checked against https://eclipse-score.github.io/process_description/main/process_areas/security_management/security_management_workflow.html and points are mentioned in the responsibility. some are mentioned in later sentences like audit, reviews, training, and so on.
Regarding table, i am not sure if its really needed. its only a single list.

@masc2023 doing changes in safety will need one more approval from safety colleagues. in this PR i have tried to to minimal changes in safety. if these points are agreed here, we can collect all such minor points and check with safety team if they are ok and if yes plan it via a separate task. (if this is the only point then i can also do the changes in this PR but would need to check with safety if they are ok with such changes).

process/process_areas/security_management/security_management_roles.rst

process/roles/index.rst

masc2023 · 2026-01-30T08:56:52Z

process/folder_templates/modules/module_name/docs/manual/security_manual.rst


-Security Manual Template
-=========================
+Module Security Manual


Please remove Module, otherwise it is not consistent with Safety, which is just called Safety Manual in the folder structure or we need to be consistent for all documents, Safety and Security have same either using Module or not. I see also for Safety, sometimes used, sometimes not.

We can rework this for all the templates. I would propose to remove all "Feature, Module, Component" in the document template names because it is obvious from the folder these are in. I would keep/add for all platform level ones as there will not be a dedicated folder for this. I would suggest to create a seperate ticket for this alignment.

Ticket created here, #549, @aschemmel-tech are you able to join Security Team Meeting on Friday, 11-12 to discuss or shall we align a separate meeting for that?

Propose at least for the Module folder, to remove all "Module" in the tree.
Propose to add Platform in the tree, beside Stakeholder Requirements
Propose for the Feature Folder to remove "Feature" in the three.
Propose for the Component Folder to remove "Component" in the three.

As discussed, have removed module name. Let me know if anything is still missing.

masc2023 · 2026-01-30T09:36:27Z

process/process_areas/security_management/security_management_roles.rst

   * Refusing the approval of work products as defined in the workflows
   * Refusing the approval of his team's role nomination (i.e. requesting that the role will be withdrawn)
+
+.. role:: Security External Auditor


Now we have two external Auditor, a general one in Safety Management and one for security, either one generic, covering both otherwise should rename in Safety to Safety External Auditor

the skills needed for auditing are different. For safety it is mentioned that the external auditor needs experience in safety or is a safety manager. we cant reuse the same for security, so i created a similar one. it can happen that one person has both the skills (security and safety know how) and performs the audit. but felt its better to describe the expectation clearly.

also, copied the idea from safety where they clearly define what is the expected qualification and role of an auditor for safety and changed to security here.

Option 1, add skills to other Role and put it to Overall Roles or keep it and change External Auditor in Safety to Safety External Auditor

masc2023 · 2026-01-30T11:27:05Z

process/process_areas/security_management/security_management_roles.rst

-   * Creates and monitors the completeness of the security package
-   * Creates and maintains the Security Manual
-   * Supports creation and maintaining of the SBOM
+   * Creates and maintains following Security artifcats at platform level: Platform Security Plan, Platform Security package, Platform Security Manual, Platform SBOM


But if we do that, we should do it also for Safety Manager to be consistent, or not?

process/process_areas/security_management/security_management_getstrt.rst

process/process_areas/security_management/security_management_concept.rst

masc2023 · 2026-01-30T12:46:09Z

process/process_areas/quality_management/guidance/quality_review_checklist.rst

          - Link to checklist
        * - SecMP_00_01
-          - :need:`gd_chklst__security_plan`
+          - :need:`gd_chklst__module_security_plan`


No, Safety is also only for Module, the naming is misleading, in Safety we have no products on Platform level, see my other comments, platform to be deleted

masc2023 · 2026-01-30T12:46:39Z

process/folder_templates/platform/security_planning/platform_security_plan_fdr.rst

+   # *******************************************************************************
+
+
+Platform Security Plan Formal Review Report


no platform for safety, remove

could not comment for previous point so entering it here. have replaced gd_chklst__module_security_plan to gd_chklst__security_plan

sorry to repeat, but once again even if we reuse the template for platform, how will we get to know that we need to have a review checklist also at platform level?

Compare #574, will introduce same for safety now

process/folder_templates/platform/security_planning/platform_security_plan.rst

masc2023 · 2026-01-30T12:47:09Z

process/folder_templates/platform/security_analysis/platform_security_package_fdr.rst

+   # *******************************************************************************
+
+
+Platform Security Package Checklist


noting on platform for safety, remove

as discussed, corrected safety to include platform.

Check with your team member, #574, otherwise you will get merge issued by changing safety topics in this PR

masc2023 · 2026-01-30T12:47:21Z

process/folder_templates/platform/security_analysis/platform_security_manual.rst

+   # SPDX-License-Identifier: Apache-2.0
+   # *******************************************************************************
+
+Platform Security Manual


nothing on platform, remove

where do we write assumption of use at platform level?

Check https://github.com/eclipse-score/score/pull/2600/changes#diff-7f272b7f9c50eb63f3494528ebdc52d9263a37cf52e0e35c21f102f70f6050a4, will introduce Safety Manual, assumptions of use should be here https://eclipse-score.github.io/score/main/requirements/platform_assumptions/index.html

aschemmel-tech

See inline answers to existing comments

aschemmel-tech · 2026-02-03T10:19:31Z

process/process_areas/security_management/guidance/checklist_security_package.rst

+Security Package Formal Review Checklist
+========================================
+
+.. gd_chklst:: Platform Security Package Formal Review Checklist


Also in other process areas (architecture, requirements) we did not create separate checklist guidances (gd_chklst_...) for all the different levels as these have the same content. Just the document templates stored for direct usage in the folder template section are "level specific".

process/process_areas/security_management/guidance/checklist_security_plan.rst

sunildevda · 2026-02-12T18:44:37Z

@pahmann , @masc2023 , @PandaeDo , @aschemmel-tech I have fixed the findings. there are some open points. could you please check and provide your feedback for the new changes?

pahmann · 2026-02-27T10:16:46Z

Only checked for my findings and they were resolved.

PandaeDo

Fine for me

masc2023

Fine for now, need to recheck after safety templates update has been done

masc2023 · 2026-02-27T13:24:07Z

Fine for now, need to recheck after safety templates update has been done

@sunildevda , please resolve your merge conflicts first

Update Security Management process

e5460a1

sunildevda requested review from PandaeDo, aschemmel-tech, masc2023 and pahmann as code owners January 30, 2026 07:21

sunildevda requested a review from CryptoNutcase January 30, 2026 07:21

pahmann requested changes Jan 30, 2026

View reviewed changes

process/folder_templates/modules/module_name/docs/manual/security_manual.rst Outdated Show resolved Hide resolved

PandaeDo requested changes Jan 30, 2026

View reviewed changes

Resolve copyright issues for year

3f12737

masc2023 requested changes Jan 30, 2026

View reviewed changes

masc2023 mentioned this pull request Feb 3, 2026

Improvement: Alignement for Safety/Security Work Products and Templates #549

Open

2 tasks

masc2023 linked an issue Feb 3, 2026 that may be closed by this pull request

Improvement: Alignement for Safety/Security Work Products and Templates #549

Open

2 tasks

aschemmel-tech reviewed Feb 5, 2026

View reviewed changes

Fix review findings

9b64b79

masc2023 mentioned this pull request Feb 18, 2026

issue_2501_addition_of_missing_safety_docs_templates #574

Open

Fix review findings

af76784

pahmann approved these changes Feb 27, 2026

View reviewed changes

PandaeDo approved these changes Feb 27, 2026

View reviewed changes

masc2023 approved these changes Feb 27, 2026

View reviewed changes

		# *******************************************************************************


		Platform Security Plan Formal Review Report

		# *******************************************************************************


		Platform Security Package Checklist

Conversation

sunildevda commented Jan 30, 2026

Uh oh!

github-actions bot commented Jan 30, 2026

Uh oh!

pahmann left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

PandaeDo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sunildevda Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aschemmel-tech left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sunildevda commented Feb 12, 2026

Uh oh!

sunildevda Feb 12, 2026 •

edited

Loading