# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-VULN-001
title: Scan dependencies for known vulnerabilities continuously
finding:
  title: Known vulnerabilities in dependencies are not detected
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: partial
tags: [vulnerability, sca]
description: |
  The full resolved dependency tree of every project is matched against public vulnerability databases on every change and at least every {{ scan_interval_hours }} hours for the default branch and deployed versions.
rationale: |
  New vulnerabilities are published every day for code that has not changed. Scanning only on change misses them for projects that are not actively developed.
impact: |
  Findings must be triaged. Expect noise at first.
notes: |
  Scan the lockfile or SBOM (resolved versions), not only the manifest (declared ranges).
parameters:
  - name: scan_interval_hours
    type: integer
    description: Maximum time between two scans of the same project.
    unit: hours
    default: 24
    minimum: 1
    maximum: 168
audit:
  manual: |
    1. Check that a dependency scan runs on change requests.
    2. Check that a scheduled scan covers each default branch and deployed version at least every {{ scan_interval_hours }} hours.
    3. Check that results reach the owning team.
  checks:
    - id: postmortem
      engine: postmortem
      description: "a scanner in pipelines, on change and on a schedule"
      spec:
        command: postmortem harden --json
        control: CB-DEP-VULN-001
        coverage: partial
remediation:
  manual: |
    1. Add a dependency scan to pipelines and a scheduled scan of default branches and deployed versions.
    2. Route findings to the owning team.
references:
  - title: Open Source Vulnerability format
    url: https://ossf.github.io/osv-schema/
    publisher: OpenSSF
    kind: standard
    accessed: 2026-10-16
  - title: NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1
    url: https://csrc.nist.gov/pubs/sp/800/218/final
    publisher: NIST
    kind: standard
    accessed: 2026-10-16
  - title: OWASP Software Component Verification Standard
    url: https://owasp.org/www-project-software-component-verification-standard/
    publisher: OWASP
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: RA-5
    relation: related
  - framework: iso27001-2022
    framework_version: '2022'
    id: A.8.8
    relation: related
threats:
  - framework: cwe
    id: CWE-1395
related_controls:
  - id: CB-DEP-VULN-003
    type: related
  - id: CB-DEP-INV-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16