Skip to content

Added RDX risk alignment. Add safety. Minor refactor - #1120

Merged
stevespringett merged 10 commits into
2.0-devfrom
2.0-dev-safety
Oct 15, 2026
Merged

Added RDX risk alignment. Add safety. Minor refactor#1120
stevespringett merged 10 commits into
2.0-devfrom
2.0-dev-safety

Conversation

@stevespringett

@stevespringett stevespringett commented Sep 21, 2026

Copy link
Copy Markdown
Member

Supersedes #1041. Closes #954.

@stevespringett
feat: safety impact of changes on classified contexts (#954, #1041)
743295a 
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
feat: damage scenarios and impact methodology (ISO/SAE 21434, RDX ali…
de22e2c 
…gnment). Added test cases.

Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
refactor: align threat and risk models with ISO 31000, ISO/SAE 21434,…
78f96fe 
… and ISO 26262

Threat scenarios carry feasibility only, risks pair them with damage scenarios and reference one way, and naming, statuses, and scales are now unified across the two models.

Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett stevespringett added this to the 2.0 milestone Sep 21, 2026
@stevespringett stevespringett self-assigned this Sep 21, 2026
@stevespringett
stevespringett requested a review from a team as a code owner September 21, 2026 02:37
@stevespringett stevespringett added proposed core enhancement request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration labels Sep 21, 2026
@devashridatta-dotcom

devashridatta-dotcom commented Sep 21, 2026

Copy link
Copy Markdown

Thanks Steve, this looks like the right CycloneDX-native direction. I see that #1120 supersedes #1041 and closes #954. The mapping to SRAC is clear to me: triggeredBy covers the change trigger, risks.assessments[] covers change impact analysis, safetyIntegrityLevels[] carries the classified safety context, and conclusion/evidence support release decisioning.
I’ll review closely and add a few comments, mainly around preserving SRAC semantics, SPDX alignment notes, canonical safety level tokens, and whether safety integrity should also be allowed on requirements or only on blueprint asset classifications.

@devashridatta-dotcom devashridatta-dotcom mentioned this pull request Sep 21, 2026
Open
@devashridatta-dotcom

devashridatta-dotcom commented Sep 21, 2026

Copy link
Copy Markdown

Opened #1122 as the follow-up CycloneDX Safety Perspective proposal for SRAC and safety impact workflows. The intent is to document how safety stakeholders can use the #1120 model consistently across CVE and non-CVE safety triggers, without adding a competing SRAC object.

@jkowalleck

jkowalleck commented Sep 28, 2026

Copy link
Copy Markdown
Member

RFC notice sent on 21 September 2026.
RFC period ends on 19 October 2026.

@jkowalleck jkowalleck linked an issue Sep 28, 2026 that may be closed by this pull request
Proposal: Safety Relevance Metadata for CycloneDX #954
Open
@jkowalleck jkowalleck mentioned this pull request Sep 28, 2026
Open
@Ly-Joey Ly-Joey mentioned this pull request Oct 2, 2026
Closed
@stevespringett @jkowalleck
feat: safety impact of changes on classified contexts (#954, #1041)
ba042b4 
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett @jkowalleck
feat: damage scenarios and impact methodology (ISO/SAE 21434, RDX ali…
d617426 
…gnment). Added test cases.

Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett @jkowalleck
refactor: align threat and risk models with ISO 31000, ISO/SAE 21434,…
7312c7f 
… and ISO 26262

Threat scenarios carry feasibility only, risks pair them with damage scenarios and reference one way, and naming, statuses, and scales are now unified across the two models.

Signed-off-by: Steve Springett <steve@springett.us>
@jkowalleck

jkowalleck commented Oct 5, 2026

Copy link
Copy Markdown
Member

rebased onto 2.0-dev

@devashridatta-dotcom devashridatta-dotcom mentioned this pull request Oct 8, 2026
Draft
jkowalleck
jkowalleck reviewed Oct 15, 2026
View reviewed changes
Comment thread schema/2.0/modules/cyclonedx-risk-2.0.schema.json
"enum": [
"identified",
"assessed",
"mitigated",

@jkowalleck jkowalleck Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"mitigated" moved to risk response.
and here we use "treated" to indicate that there should be a response.

@stevespringett stevespringett added promote to tc54 Promote to Ecma Technical Committee 54 tc54 reviewed Ecma TC54 has reviewed the feature candidate tc54 accepted Ecma TC54 has accepted the feature candidate RFC vote accepted labels Oct 15, 2026
@stevespringett
Aligned test cases to match recent changes in main.
fd6ea25 
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
stevespringett merged commit 7272b6c into 2.0-dev Oct 15, 2026
43 of 54 checks passed
@stevespringett
stevespringett deleted the 2.0-dev-safety branch October 15, 2026 22:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkowalleck jkowalleck jkowalleck left review comments

Assignees

@stevespringett stevespringett

Labels

promote to tc54 Promote to Ecma Technical Committee 54 proposed core enhancement request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration RFC vote accepted tc54 accepted Ecma TC54 has accepted the feature candidate tc54 reviewed Ecma TC54 has reviewed the feature candidate

Projects

None yet

Milestone

2.0

Development

Successfully merging this pull request may close these issues.

Proposal: Safety Relevance Metadata for CycloneDX

4 participants

@stevespringett @devashridatta-dotcom @jkowalleck @Luisaguirrecanepa