--- title: "What a Patch Must Prove for Everyone: Announcing OSERA Remediation Standards" description: Establishing OSERA Remediation Standards an open specification defining what a patch must prove before it can be safely consumed in a regulated environment image: https://www.finos.org/hubfs/Community%20Blog/OSERA%20Remediation%20Standards%20Image.png --- [![FINOS](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/finos-logo.png?width=543&height=126&name=finos-logo.png "FINOS")](https://finos.org) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://www.finos.org/osff-ny-26-landing-page) - [Fluxnova Con at OSFF NY](https://www.finos.org/fluxnova-con-at-osff-ny-2026) - [OSFF NY Workshops](https://www.finos.org/osff-ny-2026-workshops) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://www.finos.org/osff-ny-26-landing-page) - [Fluxnova Con at OSFF NY](https://www.finos.org/fluxnova-con-at-osff-ny-2026) - [OSFF NY Workshops](https://www.finos.org/osff-ny-2026-workshops) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) ![Community Blog](https://www.finos.org/hubfs/10.04.19.FINOS_WebsiteBanners_3.png) # Community Blog # What a Patch Must Prove for Everyone: Announcing OSERA Remediation Standards October 22, 2026 [FINOS Team](https://www.finos.org/blog/author/finos-team) What began across the Open Source Enterprise Resiliency Alliance (OSERA) as targeted patching experiments has expanded into an extensive patch library covering older Java ecosystems, complex build variations, and end-of-life frameworks. To bridge the gap between open source fix creation and enterprise deployment, the industry needs a stable, transparent, bank-consumable format. Through FINOS, the financial services community is establishing [**OSERA** **Remediation Standards**](https://standards.osera.finos.org/) - an open specification defining what any patch must prove before it can be safely consumed in a regulated production environment. ![OSERA Remediation Standards Image](https://www.finos.org/hs-fs/hubfs/Community%20Blog/OSERA%20Remediation%20Standards%20Image.png?width=500&height=280&name=OSERA%20Remediation%20Standards%20Image.png) ## **The Challenge: Patching Is Only Half of the Problem in Regulated Finance** In regulated finance, taking an open source patch into production is rarely as simple as pulling an upstream update. Upgrading software in banking environments triggers regression testing, change-management reviews, and strict audit requirements across thousands of mission-critical applications. Today, more than 90% of enterprise codebases carry open source components that are four or more years out of date, and 60% of security breaches occur where a patch was already available upstream but remained unapplied due to fear of breaking live services. This operational hurdle has historically locked institutions into an expensive, duplicative "fork tax". When an unpatched vulnerability surfaces in a legacy dependency, banks either maintain private, bespoke internal forks or contract external vendors independently to fix the same common CVEs behind closed doors. Compounding this, regulatory frameworks like DORA, NIS2, and the EU Cyber Resilience Act (CRA) demand explicit, verifiable proof of what changed, how it was validated, and what surface area was affected. Without verifiable provenance and compatibility evidence, even a functional fix cannot clear enterprise deployment controls. ## **The Solution: osera open remediation standards** The OSERA Remediation Standards establish an open, verifiable bar for producing, publishing, and consuming backpatches. Instead of relying on proprietary assurances, the standards transform an informal "we fixed it" into verifiable proofs that machines, developers, and auditors can independently inspect. Developed through collaboration among member financial institutions, patch producers, and open source infrastructure leaders, the standards are released under the Community Specification License to ensure they remain open, vendor-neutral, and free for anyone to adopt. > "An open, verifiable standard for remediation delivers trust at scale—especially critical as the industry consumes open source from the community and from multiple patch vendors and coalitions." — **Dov Katz**, MD & Distinguished Engineer, Morgan Stanley; Chair, OSERA Remediation Standards Working Group, [*Press Release*](https://www.finos.org/press/major-banks-back-osera-open-source-security-standards-and-fixes) By standardizing the verification evidence required at consumption, the specification establishes a single open acceptance gate: any package from any producer must clear the same rigorous criteria to enter the enterprise supply chain. ## **value beyond osera** The Remediation Standards establish a shared industry bar that creates a common playing field across multiple industry roles. **One Acceptance Gate:** Any package from any producer enters OSERA repositories only if it complies — the same bar no matter who produced the fix. **Commercial patch producers:** Comply once, ship into every member bank. The standard replaces per-bank due diligence with shared, verifiable evidence. **SCA & supply-chain vendors:** One industry-wide lingua franca for patches and attestations — SBOM, VEX, provenance, signing — to build products against. ## **Get Involved: what's next** The OSERA Remediation Standards are publicly accessible, open source, and built for collective participation. As the community works together to build a more resilient software supply chain, we invite organizations and engineers to get involved: - [**View the OSERA Prospectus**](https://www.finos.org/hubfs/Projects%20%2B%20SIGs/OSERA/OSERA_Prospectus.pdf) - [**Explore the Standards**](https://standards.osera.finos.org/): Browse the full catalog of standards, lifecycle documentation, and reference examples at[standards.osera.finos.org](https://standards.osera.finos.org/). - [**Adopt and Provide Feedback**](https://github.com/finos-osera/remediation-standards): Inspect the specification, submit feedback, or contribute directly via GitHub at[github.com/finos-osera/remediation-standards](https://github.com/finos-osera/remediation-standards). - [**Join a Working Group**](https://www.google.com/search?q=https://osera.finos.org/workstreams): OSERA Working Groups are open to all FINOS members. Learn more about current initiatives, working group agendas, and participation opportunities at[osera.finos.org/workstreams](https://www.google.com/search?q=https://osera.finos.org/workstreams).   --- ### **Get Involved WITH FINOS** [**FINOS Good First Issues**](https://github.com/search?q=org%3Afinos+is%3Aopen+label%3A%22good+first+issue%22&unscoped_q=is%3Aopen+label%3A%22good+first+issue%22) - Looking for a place to contribute? Take a look at good first issues across FINOS projects and get your feet wet in the FINOS community. [State of Open Source in Financial Services Report](https://www.finos.org/state-of-open-source-in-financial-services-2024) - Learn about what is really happening around open source in FSI. [**This Week at FINOS Blog**](https://finos.org/this-week-at-finos?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See what is happening at FINOS each week. [**FINOS Landscape**](https://landscape.finos.org/?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See our landscape of FINOS open source and open standard projects. [**Community Calendar**](https://calendar.finos.org)- Scroll through the calendar to find a meeting to join. [**FINOS Slack Channels**](https://finos.org/blog/finos-announces-new-community-slack?utm_campaign=20210428%20-%20FINOS%20All%20Community%20Call%20-%20Q2%202021&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - The FINOS Slack provides our Community another public channel to discuss work in FINOS and open source in finance more generally. [**Project Status Dashboard**](https://metrics.finos.org/goto/7bfcb03f027a1406c997d731d4715ea7?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See a live snapshot of our community contributors and activity. [**Events**](https://finos.org/news-and-events?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - Check out our upcoming events or email [**marketing@finos.org**](mailto:marketing@finos.org) if you'd like to partner with us or have an event idea. [**FINOS Open Source in Finance Podcasts**](https://anchor.fm/finos) - Listen and subscribe to the first open source in fintech and banking podcasts for deeper dives on our virtual "meetup" and other topics.   ### Share this: - [Tweet](https://twitter.com/share) [← A Shared Reference Library for Software Governance: Announcing SDLC Common Controls Catalog (SDLC Controls)](https://www.finos.org/blog/announcing-sdlc-common-controls-catalog) [![FINOS Logo](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/FINOS_Icon_Wordmark_White.png?width=689&height=971&name=FINOS_Icon_Wordmark_White.png "FINOS Logo")](https://www.finos.org/) [![Twitter logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/twitter-blue-social-panel.png)](https://twitter.com/finosfoundation) [![GitHub logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/github-black-social-panel.png)](https://finos.github.io) [![LinkedIn logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/linkedin-blue-social-panel.png)](https://www.linkedin.com/company/finosfoundation) [![SlideShare logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/slideshare-logo.png)](https://www.slideshare.net/finosfoundation) [![YouTube logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/youtube_logo-1.png)](https://www.youtube.com/channel/UCfJAdRALzJ7J7snubrb_Y-Q) [Contact Us](https://www.finos.org/contact-us) [info@finos.org](mailto:info@finos.org) +1 (650) 665-9773 [Privacy |](https://www.finos.org/privacy-policy)[Terms of Service |](https://www.finos.org/terms-of-service)[Community Code of Conduct |](https://www.finos.org/code-of-conduct)[Email Preferences](https://www.finos.org/hs/manage-preferences/unsubscribe-simple)