Planned frameworks and targets
Compliance work that is planned but not in the product today, full SLSA, NIST SSDF and crypto or post-quantum readiness reports with controls and OSCAL, and per-system EU AI Act classification, and what you can use meanwhile.
The ten frameworks in the overview are the complete list the API accepts today. Creating a report with any other framework value returns 400 {"error":"framework and name are required"}, and filtering by one returns 400 {"error":"unknown framework"}.
Planned
| Item | Status | What exists meanwhile |
|---|---|---|
| SLSA report with controls and an OSCAL export | Planned (a SLSA level target is available) | SLSA provenance and attestation counts are loaded as report evidence, for example in the Coverage report’s provenance row, and are in the evidence bundle’s control-posture.json. Software Factory shows the SLSA level each repository reaches on Trust and SLSA |
| NIST SSDF (SP 800-218) report with controls and an OSCAL export | Planned (an SSDF target is available) | The OWASP DSOMM and ISO/IEC 27001 reports cover much of the same secure-development ground |
| Crypto and post-quantum readiness report | Planned (an allowed-algorithm policy over your CBOM is available as a target) | CBOM scans (vulnetix cbom) feed the CRA cryptography control and the Coverage cbom row; CBOM documents are in the evidence bundle |
| EU AI Act targets (a declared risk class and obligations per AI system) | Planned | The EU AI Act report maps 21 articles today; classifications are attached as evidence on Articles 5 and 6 |
The report-shaped items in this table are not available yet; the targets they would use are. These pages will be updated when each one ships.