On April 11, China’s National Information Security Standardization Technical Committee (NISSTC) released the Information Security Technology - Evaluation Method for Open Source Code Security of Software Products (Draft for Comment) (the "Draft") for public consultation by June 9, 2023.

The Draft specifies the goals, indicator system, and evaluation method for security evaluation for open source code of software products. The evaluation indicator system involves sources of open source code, quality of open source code, intellectual property rights to open source code, and open source code management capabilities. The Draft stipulates that, the evaluation process mainly includes four stages: evaluation preparation, plan formulation, on-site implementation, and analysis and assessment. The party conducting the evaluation should comprehensively adopt the basic evaluation methods, such as interview, inspection, and test, during the security evaluation of open source code to verify whether the evaluation materials provided by the party being evaluated meet the requirements of under the indicators. The Draft also requires the party being evaluated to ensure the security of the open source code contained in its software products according to the actual conditions of the industry and its enterprise scale, and based on the evaluation system and rules.

(Source: China’s National Information Security Standardization Technical Committee)