owasp/owasp-open-source-intelligence-standardAn open, vendor-neutral verification standard for traceable, reviewable, and rights-aware open-source intelligence. Current release: OOVS v0.1.0.
Every judgment traceable to its origin · every requirement testable against published criteria · AI output never mistaken for evidence
Read the standard · The ten requirements · For evaluators · OWASP project page
An intelligence product is only as good as the account you can give of it. Most open-source work cannot answer four questions under scrutiny:
| Question | What OOVS requires | |
|---|---|---|
| 01 | Where did this come from? | Origin, time, method, and handling history travel with every item, and originals stay distinguishable from copies |
| 02 | Is it independently corroborated? | Independence counted by distinct origins, not mentions. Reposts and machine restatements of one source never become confirmation through repetition |
| 03 | Who is accountable for the judgment? | Observation, inference, assumption, and unknown stated separately. Automated output is an aid, never a witness, and a named person stays answerable |
| 04 | Does the caveat survive contact? | Confidence, limits, and handling constraints travel to the point of action, and a correction can reach everyone who received the product |
What the standard asks of a working analyst.
Provenance traced to origin · corroboration established independently · judgments attributed to a named person
releases hashed so a recipient can check their copy · corrections that reach everyone who saw the original
Read itThe normative text, ten requirements with objectives, evidence, procedures, and pass criteria. |
Automate itRequirements and acceptance tests published as data, with JSON Schema, so tooling can consume them. |
Record a resultA portable assessment format, with a worked synthetic example you can copy. |
Also worth reading: the release notes, the safety, rights, and misuse policy, governance, and how OOVS sits against prior art.
Each requirement states an obligation, the evidence that demonstrates it, how an assessor tests it, and what counts as failure. None depends on a particular tool, vendor, or platform.
| ID | Requirement |
|---|---|
OOVS-v0.1.0-01 | Authorised purpose and proportionality |
OOVS-v0.1.0-02 | Collection boundary and data minimisation |
OOVS-v0.1.0-03 | Source provenance and integrity |
OOVS-v0.1.0-04 | Source and claim assessment |
OOVS-v0.1.0-05 | Corroboration and confidence |
OOVS-v0.1.0-06 | Analytic transparency and reproducibility |
OOVS-v0.1.0-07 | Rights, privacy, and safeguarding |
OOVS-v0.1.0-08 | AI and automation assurance |
OOVS-v0.1.0-09 | Dissemination and action controls |
OOVS-v0.1.0-10 | Governance, audit, and improvement |
