The CII Best Practices Badge was a free, project-level way for open-source software projects to publicly document security and development practices. It is still available under its current name, the OpenSSF Best Practices Badge: the program was formally renamed on December 24, 2021. Projects now use BadgeApp to answer criteria and provide justifications; automated checks verify many, but not all, of the answers.
What the CII Best Practices Badge was
The Core Infrastructure Initiative (CII) Best Practices Badge was a digital badge program for Free/Libre and Open Source Software (FLOSS) projects. A project used BadgeApp to describe how it handled development and security, making its practices and supporting explanations publicly reviewable. The Linux Foundation’s 2016 explainer emphasized that the badge was for a project, not an individual. Read the Linux Foundation’s explainer.
As an Amazon Associate I earn from qualifying purchases.
The program was designed to help users assess how a project approaches software quality and security. The Open Source Security Foundation (OpenSSF) says consumers can use the badge to identify FLOSS projects following best practices and more likely to produce higher-quality secure software. See the OpenSSF program page.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIs the CII badge still available?
Yes. The program continues as the OpenSSF Best Practices Badge, maintained by the OpenSSF Best Practices Working Group. The formal rename took place on December 24, 2021. The service remains free and self-service through BadgeApp. Open BadgeApp.
#1 Best Overall
How a project earns a badge
- Open BadgeApp and select the project. The badge applies to a software project, rather than to a developer’s personal credentials.
- Complete the criteria form. Provide answers about the project and explain how it meets applicable practices.
- Address automated checks. BadgeApp checks many criteria automatically; other answers rely on the project’s stated information and justifications.
- Make the project’s practices reviewable. Public answers allow users to examine what the project claims rather than treating the badge as a private certification.
- Maintain the practices and evidence. A badge depends on ongoing project work such as testing, documenting releases, and handling vulnerability reports.
The badge is an assessment of stated project practices and supporting checks, not a guarantee that software is secure or free of defects.
Passing, silver, gold, and Baseline: what differs?
The original badge series has three assurance levels—passing, silver, and gold. The current site also supports OpenSSF Baseline levels, which are a separate criteria family. The criteria grow more demanding across the metal levels:
| Option | What it emphasizes | Examples of criteria |
|---|---|---|
| Passing | Core practices for project transparency, development, and security. | A stable project website, explicit FLOSS license, HTTPS, secure installation and API documentation, public version control and release notes, tracked bugs and vulnerability reports, working builds, static analysis, automated tests, dynamic checks such as fuzzing or web scanning, and developers familiar with secure software. |
| Silver | More formal governance, resilience, and security controls. | Documented governance, a bus factor of at least two, security requirements, dependency monitoring, at least 80% statement coverage, signed releases, input validation, and hardening. |
| Gold | Deeper review, independence, release integrity, and test coverage. | Two significant contributors who are not associated with one another, two-factor authentication, at least 50% of modifications reviewed, reproducible builds, continuous integration, at least 90% statement coverage, at least 80% branch coverage, modern TLS, and a security review. |
| OpenSSF Baseline | A distinct criteria family available on the current site. | Baseline levels are supported, but the cited program summary does not enumerate their criteria here. |
These are project practices, not a linear rating of individual developers. A higher level calls for more documented and maintained controls, so projects should choose based on their capacity to meet the requirements continuously.
What the numbers do—and do not—tell you
The OpenSSF badge repository describes 10% as an average for projects pursuing a passing badge. It is a program-level historical estimate, not a current success-rate measurement for all projects. View the badge repository.
A 2016 Linux Foundation description of BadgeApp reported 94% statement coverage and more than 3,000 checked assertions. Those figures describe the application at that time; they should not be read as a current measure of BadgeApp’s checks or of the quality of any project’s software. See the 2016 description.
Quick Recap
How to interpret a badge
- Use it as a transparency signal. Review the project’s answers and justifications, rather than relying only on the badge graphic or level.
- Check the evidence relevant to your use. Release practices, vulnerability reporting, testing, and dependency monitoring may matter differently depending on how you plan to use the software.
- Do not treat it as a security warranty. Automated checks cover many criteria, but project answers and practices cannot establish that every vulnerability has been found or prevented.
- Consider maintenance capacity. Higher levels entail practices that a project must continue to document and perform.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
