1 Scope

1.1 This standard applies to network-connectable products that shall be evaluated and tested for vulnerabilities, software weaknesses and malware.

1.2 This standard describes:

1. a) Requirements regarding the software developer (vendor or other supply chain member) risk management process for their product.

2. b) Methods by which a product shall be evaluated and tested for the presence of vulnerabilities, software weaknesses and malware.

3. c) Requirements regarding the presence of security risk controls in the architecture and design of a product.

Summary of Topics

This revisions of ANSI/CAN/UL 2900-1, dated April 14, 2023, are issued to reflect the latest ANSI and SCC approval dates, and to include the following;

– Editorial Changes; 2.1, 6.7, 11.7, 15.5 and 15.6.

– Addition of Inclusive Language; 3.30, 8.5

– Clarification of Product Documentation; 4.1

– Updated Versions of Reference Material; 2.1, 6.1, 11.5

– Addition of Paragraph Numbering; 7.1.4 and 7.1.5

– Clarification of Definitions and Term Usage; 3.14A, 8.3 and 8.8

– Clarification of Sensitive Data Documentation; 10.1 and 15.1

– Removal of Redundant Statement; 11.5

– Self-Reference Correction; 12.3 and 12.5

– Clarification of Structured Penetration Testing Requirements Documentation; 16.1 and 16.2

– Clarification of Software Composition, Static Source Code Analysis and Static Binary and Bytecode Analysis Requirements Documentation; 3.42A, Section 13, 14.2, 17.1, 17.2, 17.3, Section 18, 19.2 – 19.5, Section A2, Figure A1.