"The project MUST have performed a security review within the last 5 years. This review MUST consider the security requirements and security boundary."  – – Best Practices Badging Criteria _{[security-review G]}

...

For each one, additional information on the question is available to be read by clicking the arrow following the question.

Once the security review is done and scored, the application owner 

Security Knowledge

...

Implement Secure Design

Do the committers and PTL apply secure design principles when reviewing software for merging?

...

Know Common Errors

Do the committers and PTL understand commonly found errors (and how to counter or mitigate them)? Do they apply these principles when reviewing software for merging?

...

No Leaked Credentials

Do the committers and PTL verify that there are no non-test credentials and no non-test private keys in code to be merged?

...

Security Documentation

Documentation Architecture

...

Documentation Security

Does your project have a description of what a user of your project can and cannot expect in terms of security from the software produced by the project, (In other words, what are its 'security requirements'?)

...

Assurance Case

Does your project actually meet its documented security requirements?

...

Vulnerability Mitigation

Vulnerabilities Critical Fixed

...

Vulnerabilities Fixed 60 Days

...

Non-Cryptographic Software Questions

...

Hardening

Does your project apply hardening mechanisms so that software defects are less likely to result in security vulnerabilities?

...

Cryptographic-specific Software Questions

...

Crypto Random - Generic

Does your software use random information? If so, does it use a cryptographically secure random number generator?

...

Crypto Weaknesses

Does your software depend on any cryptographic algorithms or modes that have known serious weaknesses?

...

Crypto Working

Does your software depend on any cryptographic algorithms that are known to be broken?

...

Crypto Keylength

Does your software generate any keys? If so, do they use any default key-lengths that are considered insecure?

...

Crypto Algorithm Agility

Does your software use cryptographic algorithms? If so, can a user of ONAP switch the algorithm if one is found to be broken?

...

Crypto Certificate Verification

...

Crypto Credential Agility

...

Crypto TLS1.2

Does your software support HTTPS? If so, is the minimum version allowed TLS1.2?

...

Crypto Used Network

Does your software have network communications inbound or outbound? If so, do you support secure protocols for all such network communications?

...

Crypto Verification Private

...