Conformance programme: standards that apply
The 2 standards listed for conformance programme in the registry, each with its status, UNI (Unique Nexus Identifier) and the rules stated in its text.
- Nexus Standards: NS-11, NS-14.
- Open standards: Open Security Controls Assessment Language (OSCAL); in-toto attestation framework; Verifiable Credentials Data Model 2.0; Supply-chain Levels for Software Artifacts (SLSA) 1.1; OpenStand principles (RFC 6852).
- Data and feeds: GLEIF Golden Copy (LEI Level 1 and Level 2 data); ROR data dump.
- Couples with: Verification services; Conformance and crosswalk to external; the Global Centre for Risk and Innovation (GCRI Canada) evidence pathway; Institutional adoption pathway.
- Nexus Standards
- 2
- NS-11, NS-14
- Open standards
- 5
- named, never copied
- Data and feeds
- 2
- listed for reference
- Couplings
- 4
- with other areas
Verification and monitoring (evidence, attestations, zero-trust conformance observation)
Status proposed · trust, authorisation and assurance · NXS-STD-ST-000007.
| Rule | Text |
|---|---|
NS11-R1 | A conformance statement shall rest on an attestation, and an attestation shall name an evaluator, a mandate, evidence references and a digest. |
NS11-R2 | Under zero trust, subject and evaluator shall be distinct, and production evaluations shall run outside the subject’s trust boundary. |
NS11-R3 | Missing or unresolvable evidence shall yield INDETERMINATE or REFUSED, never PASS (NS0-P12). |
NS11-R4 | Attestations shall be append-only and superseded rather than changed; monitoring records shall be observations with record UNIs. |
NS11-R5 | Every displayed conformance value shall carry its evaluation instant and its evaluator; projections shall not store verdicts. |
NS11-R6 | Exports to Verifiable Credentials, in-toto or PROV-O are crosswalks; the Nexus attestation shall remain the record of truth. |
Conformance and crosswalk to external standards
Status proposed · trust, authorisation and assurance · NXS-STD-ST-000013.
| Rule | Text |
|---|---|
NS14-R1 | The text of an external standard shall not be reproduced; it shall be cited by identifier, clause number and URL. |
NS14-R2 | Relation claims shall come from the register and from clause sets, not from prose. |
NS14-R3 | "Compliant" and "certified" shall appear only as quotations of an authority decision cited by reference. |
NS14-R4 | Marks of standards bodies shall not form part of a Nexus name. |
NS14-R5 | Unverified register entries shall be displayed as unverified. |
Questions and answers.
Are these all the rules for conformance programme?
What does a rule identifier such as NS1-R5 denote?
Around conformance programme.
Shape the standards for conformance programme.
Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artefact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.