the legislation seems a little pointlessly broad. "open source" is just software at the end of the day so it can easily be covered by existing STIG guidelines.

the legislation seems a little pointlessly broad. "open source" is just software at the end of the day so it can easily be covered by existing STIG guidelines. these already work with Ubuntu and Redhat. https://en.wikipedia.org/wiki/Security_Technical_Implementation_Guide https://en.wikipedia.org/wiki/Security_Technical_Implementat... Open source doesnt need a special response process, and the only reason you'd want one is if youre old guard like Symantec, F5, VMWare, or Veritas and starting to become alarmed at the amount of business you're losing to open source now that "devops" is starting to catch on and a recession is in effect.