Skip to content

Back to the catalog

OSS Vulnerabilities And The Digital Operational Resilience… | Blog | Endor Labs
endorlabs.comarticle

OSS Vulnerabilities And The Digital Operational Resilience… | Blog | Endor Labs

Endor Labs breaks down the EU Digital Operational Resilience Act (DORA), applicable to financial entities from January 2025, focusing on Article 9 (patch management) and Article 25 (open source analysis/source code review), plus the January 2024 Regulatory Technical Standards Articles 10 (tracking third-party/OSS libraries) and 16 (source code review, security testing before production). It then maps these compliance requirements to concrete AppSec practices: SBOM/SCA for component inventory, proactive OSS risk scoring, vulnerability scanning, and function-level reachability analysis to prioritize remediation and generate VEX documents, noting overlap with PCI DSS requirements 6.3/11.3.

TL;DR Endor Labs explains DORA's Article 9/25 and RTS Article 10/16 OSS requirements and how SBOM, SCA, and reachability analysis satisfy them.
Open original ↗

Organisations named here

  • DORA
  • GDPR
  • PCI DSS

Technologies named here

  • Endor Labs
  • Software Composition Analysis
  • SBOM
  • EPSS

Techniques named here

  • Software Bill of Materials
  • Vulnerability Exploitability eXchange
  • Function-level reachability analysis
  • Static and dynamic source code review/testing
  • Open source analysis and vulnerability assessments/scans

Related in GRC