Deployment services: crosswalk to external standards
The external standards in the crosswalk domains of deployment services, from the register, with the relation of each to the Nexus Standards. Each row links to the issuing body, and each relation is evidenced by attestations identified by UNIs (Unique Nexus Identifier).
- Nexus Standards: NS-9, NS-11, NS-12.
- Open standards: Supply-chain Levels for Software Artifacts (SLSA); Sigstore (Cosign, Fulcio, Rekor); CycloneDX Bill of Materials (ECMA-424); OCI Image and Distribution Specifications; The Update Framework (TUF).
- Data and feeds: endoflife.date API; OSV.dev vulnerability API; deps.dev API.
- Couples with: Software and supply chain; Identification (the UNI); Monitoring services.
The process.
The crosswalk as a table: 17 external standards by domain
| Domain | External standard | Issuing body | Relation |
|---|---|---|---|
| Software and supply chain integrity | Citation File Format (CITATION.cff) | Citation File Format project | adopt |
| Software and supply chain integrity | CodeMeta software metadata vocabulary | CodeMeta project | adopt |
| Software and supply chain integrity | CycloneDX Bill of Materials specification (ECMA-424) | OWASP CycloneDX; Ecma International TC54 | crosswalk |
| Software and supply chain integrity | JSON Schema 2020-12 | JSON Schema organisation | adopt |
| Software and supply chain integrity | OCI Image Format Specification | Open Container Initiative | adopt |
| Software and supply chain integrity | OpenAPI Specification | OpenAPI Initiative (Linux Foundation) | adopt |
| Software and supply chain integrity | OpenSSF Best Practices Badge | OpenSSF | cite |
| Software and supply chain integrity | OpenSSF Scorecard | OpenSSF | cite |
| Software and supply chain integrity | Reproducible Builds definition and practices | Reproducible Builds project | cite |
| Software and supply chain integrity | SPDX (System Package Data Exchange) specification; ISO/IEC… | SPDX project (Linux Foundation); ISO/IEC JTC 1 | adopt |
| Supply chains and logistics | ISO 28000:2022 Security and resilience – Security… | ISO/TC 292 | crosswalk |
| Supply chains and logistics | ISO/IEC 27036-2:2022 Cybersecurity – Supplier… | ISO/IEC JTC 1/SC 27 | cite |
| Supply chains and logistics | NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk… | NIST | cite |
| Supply chains and logistics | OASIS Common Security Advisory Framework (CSAF) Version 2.0 | OASIS CSAF TC | cite |
| Supply chains and logistics | OpenVEX specification | OpenVEX community (OpenSSF project) | cite |
| Supply chains and logistics | Supply-chain Levels for Software Artifacts (SLSA) | OpenSSF (Linux Foundation) | adopt |
| Supply chains and logistics | WCO SAFE Framework of Standards to Secure and Facilitate… | World Customs Organization | cite |
Nexus Standards in the graph: NS-9, NS-12. A relation is a register entry, never a compliance claim.
2 Nexus Standards · 2 domains · 17 external standards · 16 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.
Crosswalk graph37 nodes and 38 links from the registry of external standards, programme areas and implementations (the external standards register, the consumers register. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.
- Nexus Standards
- 3
- NS-9, NS-11, NS-12
- Open standards
- 5
- named, never copied
- Data and feeds
- 3
- listed for reference
- Couplings
- 3
- with other areas
Software and supply chain integrity
10 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| SPDX (System Package Data Exchange) specification; ISO/IEC 5962:2021 | SPDX project (Linux Foundation); ISO/IEC JTC 1 | 3.0.1 (December 2024); ISO/IEC 5962:2021 published 9 September 2021 covers an earlier 2.x version | adopt | open | verified |
| CycloneDX Bill of Materials specification (ECMA-424) | OWASP CycloneDX; Ecma International TC54 | 1.6 (9 April 2024; ECMA-424 ratified 26 June 2024); 1.7 and ECMA-424 2nd edition reported by one source | crosswalk | open | verified |
| OpenSSF Best Practices Badge | OpenSSF | passing, silver, gold tiers | cite | open | verified |
| OpenSSF Scorecard | OpenSSF | automated checks scored 0–10 | cite | open | unverified |
| CodeMeta software metadata vocabulary | CodeMeta project | 3.0 (2023); context lists 3.1 and the repository lists 4.0 | adopt | open | verified |
| Citation File Format (CITATION.cff) | Citation File Format project | 1.2.0 | adopt | open | unverified |
| OpenAPI Specification | OpenAPI Initiative (Linux Foundation) | 3.1.1 (24 October 2024); 3.1.2 and 3.2.0 dated 19 September 2025 in the repository changelog | adopt | open | verified |
| JSON Schema 2020-12 | JSON Schema organisation | 2020-12 (current per json-schema.org) | adopt | open | verified |
| OCI Image Format Specification | Open Container Initiative | 1.1 | adopt | open | unverified |
| Reproducible Builds definition and practices | Reproducible Builds project | current | cite | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Supply chains and logistics
7 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| ISO/IEC 27036-2:2022 Cybersecurity – Supplier relationships – Part 2: Requirements | ISO/IEC JTC 1/SC 27 | 2022 (Part 1 2021, Part 3 2023, Part 4 cloud) | cite | paywalled | verified |
| NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations | NIST | Rev. 1 (May 2022), Update 1 (1 November 2024) | cite | open | verified |
| OASIS Common Security Advisory Framework (CSAF) Version 2.0 | OASIS CSAF TC | 2.0 (OASIS Standard, November 2022) | cite | open | verified |
| OpenVEX specification | OpenVEX community (OpenSSF project) | draft | cite | open | unverified |
| Supply-chain Levels for Software Artifacts (SLSA) | OpenSSF (Linux Foundation) | 1.1 (April 2025, Approved Specification); site states 1.2 is current | adopt | open | verified |
| ISO 28000:2022 Security and resilience – Security management systems | ISO/TC 292 | 2022 | compatibility profile (restricted) | paywalled | unverified |
| WCO SAFE Framework of Standards to Secure and Facilitate Global Trade | World Customs Organization | 2021 | cite | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Relation types and their evidence
| Relation | Meaning | Evidence |
|---|---|---|
cite | The Nexus Standard refers to the external standard as context. | Identifier, version and URL in the register. |
profile | The Nexus Standard constrains or specialises an open external standard (for example STAC, DCAT, PROV-O, DataCite, CAP). | Conformance tests against the external standard’s own validator where one exists. |
crosswalk | Elements of the external standard map to Nexus elements (clauses, record fields). | A crosswalk table in the register entry; each row cites the external clause by number, never by text. |
adopt | The Nexus Standards use the external standard as it is for a function (for example ISO 3166-1, SPDX, ORCID, ROR). | Validation of values against the external scheme. |
extend | A Nexus Standard adds machine-readable, real-time or provenance elements that the external standard lacks. | The extension is a Nexus clause or field; the external standard is cited as the baseline. |
gap | No external standard covers the concern; a Nexus Standard specifies it. | The gap statement in the landscape study. |
Questions and answers.
Does a crosswalk establish that a deployment services artefact conforms to these standards?
Why are some relations shown as compatibility profile (restricted)?
Why are some entries marked unverified?
Around deployment services.
Shape the standards for deployment services.
Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artefact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.