# OUT-08 Open-source dependency scanning

Domain: OUT Output Integrity & Supply Chain · HI-AAF v1.3 · Public review · https://humanintel.net/standard/out/out-08

Open-source dependencies are scanned for vulnerabilities and pinned to reviewed versions.

Open-source dependencies in the agent's codebase and infrastructure are scanned for known vulnerabilities and pinned to reviewed versions. Vulnerability findings are triaged and remediated within documented SLAs. Unpinned or unscanned dependencies are not permitted in production. This control applies standard software supply-chain hygiene to the agent context.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for OUT-08: Dependency scanning is automated and runs on every build or at a documented cadence; all dependencies are pinned; vulnerability findings are triaged within SLA; no critical vulnerabilities are unresolved past the remediation window.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Dependency scanning is automated and runs on every build or at a documented cadence.
- All dependencies are pinned.
- Vulnerability findings are triaged within SLA.
- No critical vulnerabilities are unresolved past the remediation window.

## Framework mappings

- NIST AI RMF: GOVERN 6.1
- ISO/IEC 42001: A.10.2
- OWASP LLM Top 10: LLM05
- SOC 2 (TSC): CC9.2
- EU AI Act: Art. 15(2)
- Singapore: MAIGF Trusted Development and Deployment

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, OUT-08 Open-source dependency scanning. Public review edition, July 2026. https://humanintel.net/standard/out/out-08