Category:OWASP Legal Project

{{ProjectTabs | Proj_About= Why is a legal project relevant?

The OWASP Legal Project's Secure Software Development Contract Annex (Contract Annex) helps software developers and their clients negotiate and capture important contractual terms and conditions related to the security of the software to be developed or delivered. Most contracts are silent on these issues, and the parties frequently have dramatically different views on what has actually been agreed to. Clearly articulating these terms is the best way to ensure that both parties can make informed decisions about how to proceed. The goal of the Contract Annex is simply to ensure, at each stage of the life cycle, that appropriate attention has been paid to security. An additional benefit is that this documentation can be collected together to form a "certification package" that essentially lays out the argument for why this software should be trusted to do what it claims it does. There are currently versions in English.

What are some examples of how the contract annex can be used?

Here are two examples:


 * Implementation. Developer agrees to provide and follow a set of secure coding guidelines and to use a set of common security control programming interfaces (such as the OWASP ESAPI). Guidelines will indicate how code should be formatted, structured, and commented. Common security control programming interfaces will define how security controls must be called and how security controls shall function. All security-relevant code shall be thoroughly commented. Specific guidance on avoiding common security vulnerabilities shall be included. Also, all code shall be reviewed by at least one other Developer against the security requirements and coding guideline before it is considered ready for unit test.
 * Security Analysis and Testing. Developer will perform application security analysis and testing (also called "verification") according to the verification requirements of an agreed-upon standard (such as the OWASP ASVS). The Developer shall document verification findings according to the reporting requirements of the standard. The Developer shall provide the verification findings to Client.

What's new?


 * OWASP Enterprise Security API (ESAPI) has been integrated into the OWASP Secure Software Development Contract Annex
 * OWASP Application Security Verification Standard (ASVS) has been integrated into the OWASP Secure Software Development Contract Annex



Proj_Documentation= {{OWASP Book|4037498}} You can view the content in the wiki at OWASP_Secure_Software_Contract_Annex More About the Contract Annex
 * One Page Datasheet (Word, PDF)

Related projects


 * OWASP Top Ten
 * OWASP ASVS Project
 * OWASP ESAPI

Contract Annex
OWASP Contract Annex - Release (This is the current official release version) Download free:

OWASP Contract Annex - Release


 * [[Image:OWASP Secure Software Contract Annex.doc]]

|

Proj_Mail= Project News


 * 03/20/2009 - OWASP Contract Annex updated to support the use of OWASP ESAPI.
 * 01/22/2009 - OWASP Contract Annex updated to support the use of OWASP ASVS.
 * 01/01/2009 - OWASP Contract Annex language integrated into the SANS Application Security Procurement Language.
 * 11/30/2006 - OWASP Contract Annex Release version published.

Mailing List Subscribe here [mailto:owasp-legal(at)lists.owasp.org Use here] |

Proj_Related= OWASP Top Ten |

Proj_Contributors= Project Leader Jeff Williams Project Contributors Mike Boberski

The OWASP Legal project is sponsored by:



Users and Adopters

Coming soon! Please let us know how your organization is using the OWASP Contract Annex. Include your name, organization's name, and brief description of how you use the annex. The project lead can be reached at Jeff Williams Thanks for supporting OWASP! }} This project licensed under the Licensed under Creative Commons Attribution ShareAlike 3.0.

= Articles Below - More About the Contract Annex and Using It =