Key takeaways
- The standard did not start inside ISO.
- Per The Open Group's own version history, both 2018 parts were technically equivalent to its own O-TTPS Version 1.1.1, while the original single-document 2015 edition had been equivalent to Version 1.1.
- Read Part 1 before Part 2 — Part 1 sets the mandatory requirements; Part 2 only makes sense as the assessment procedure for those requirements, not a standalone checklist.
ISO/IEC 20243, "Information technology — Open Trusted Technology Provider™ Standard (O-TTPS)," is an ISO/IEC JTC 1 International Standard aimed at a specific, narrow supply-chain risk: a commercial off-the-shelf (COTS) ICT product arriving maliciously tainted (deliberately modified by an adversary somewhere in the supply chain) or counterfeit (not genuinely what it claims to be). Unlike broader supply-chain-risk standards that cover any kind of supplier risk, O-TTPS focuses specifically on this integrity question across a product's full life cycle — design, sourcing, build, fulfillment, distribution, sustainment and disposal — making it a natural companion to the SBOM and component-provenance work firmware and hardware teams already do.
From industry consortium standard to ISO/IEC standard
The standard did not start inside ISO. The Open Group's Open Trusted Technology Forum (OTTF) formed out of an industry meeting in January 2010 and was formally announced later that year as a vendor-neutral forum for technology companies, customers, governments and suppliers to develop supply-chain security guidelines together. The OTTF released an O-TTPS Snapshot in February 2012, then the full O-TTPS 1.0 — "Mitigating Maliciously Tainted and Counterfeit Products" — in April 2013. On 1 September 2015, The Open Group announced that O-TTPS (as Version 1.1) had been approved as an ISO/IEC International Standard, published as the single-document ISO/IEC 20243:2015, under Joint Technical Committee ISO/IEC JTC 1.
The 2018 split into two parts
With the next revision, O-TTPS Version 1.1.1 was published by ISO/IEC as two separate parts rather than one document:
| Part | Title | 2018 edition | What it covers |
|---|---|---|---|
| Part 1 | Requirements and recommendations | ISO/IEC 20243-1:2018 (32 pages, published February 2018, ICS 13.310/35.030) | The mandatory ("shall") requirements and recommended practices a provider implements across the product life cycle to mitigate tainted/counterfeit risk |
| Part 2 | Assessment procedures for the O-TTPS | ISO/IEC 20243-2:2018 | The procedures an assessor follows when conducting conformity assessment against Part 1's mandatory requirements, intended — per ISO's own abstract — "to ensure the repeatability, reproducibility, and objectivity of assessments" |
Per The Open Group's own version history, both 2018 parts were technically equivalent to its own O-TTPS Version 1.1.1, while the original single-document 2015 edition had been equivalent to Version 1.1. ISO's catalogue record for Part 1 notes the document "cannot fully address threats that originate wholly outside any span of control of the provider," framing O-TTPS as risk mitigation within a provider's own supply-chain practices rather than a guarantee against every possible tampering scenario.
2023: Version 1.2 and the current editions
The Open Group announced O-TTPS Version 1.2 on its blog on 5 September 2023, describing the update as a deliberate review to keep requirements current: several requirements were clarified, and — notably — "multiple requirements that were previously recommendations became mandatory," tightening the standard's bar rather than loosening it. Part 2 also gained new and more detailed examples of acceptable certification evidence. This revision became ISO/IEC 20243-1:2023 and ISO/IEC 20243-2:2023, both published in November 2023; ISO's own lifecycle record for Part 1 shows the 2018 edition's decision-to-revise on 11 January 2023 and formal withdrawal on 24 November 2023, confirming the two revision tracks (Open Group's internal versioning and ISO's edition numbering) line up to the same underlying change. One title nuance worth noting: ISO's 2018 catalogue title read "...O-TTPS — Mitigating maliciously tainted and counterfeit products — Part 1: Requirements and recommendations," while the current 2023 catalogue title reorders this to "...O-TTPS — Part 1: Requirements and recommendations for mitigating maliciously tainted and counterfeit products" — the same scope, restructured title.
The accreditation program behind the standard
Conformance to O-TTPS is not just a paper exercise — The Open Group runs a formal O-TTPS Accreditation Program, which it launched on 3 February 2014, describing it at the time as one of the first accreditation programs aimed at assuring COTS ICT product integrity and safeguarding the global supply chain. The Open Group itself acts as Accreditation Authority; organizations that pass assessment are listed on a public O-TTPS Accreditation Register and may identify themselves as an "Open Trusted Technology Provider." IBM, a founding OTTF member, piloted the program and was accredited for its Application Infrastructure and Middleware (AIM) software. Government procurement programs have referenced the standard directly — NASA's SEWP (Solutions for Enterprise-Wide Procurement) contract vehicle, for example, documents both O-TTPS Self-Assessed and Third-Party-Assessed certification paths for suppliers.
Where it fits next to SBOM and supply-chain-risk work
O-TTPS predates, and sits alongside rather than replaces, the SBOM-centric supply-chain practices SoftWSP guides already cover: it asks "could this specific unit have been tampered with or counterfeited in transit," a narrower question than the broader supplier-relationship risk management in ISO/IEC 27036 or NIST SP 800-161 (C-SCRM), and a different angle from the build-provenance focus of SLSA and in-toto attestations. A firmware or hardware maker already producing an SBOM and tracking component provenance has much of the underlying evidence an O-TTPS assessment would ask for — the standard adds a structured, assessable framework and an accreditation mark on top of that evidence.
A workable starting point
Confirm which edition you're being asked about— "O-TTPS," "ISO/IEC 20243:2015," "ISO/IEC 20243-1:2018" and "ISO/IEC 20243-1:2023" are all the same lineage at different revision points; a customer RFP citing an old edition number may still mean the current V1.2-equivalent text. Read Part 1 before Part 2— Part 1 sets the mandatory requirements; Part 2 only makes sense as the assessment procedure for those requirements, not a standalone checklist. Start with The Open Group's free C185-1 PDF(the V1.1.1-equivalent Part 1 text) to understand the requirement structure before deciding whether to purchase the current ISO/IEC 20243-1:2023 text or pursue formal accreditation. Treat "previously a recommendation, now mandatory" as the headline risk of the 2023 revision— if your last gap assessment was against the 2018 text, re-run it against the current edition rather than assuming prior conformance still holds. Decide early whether you need full third-party accreditation or just the underlying practices— government buyers citing NASA SEWP-style requirements may expect the formal Accreditation Register listing, while most private buyers are satisfied by demonstrable adherence to the same supply-chain-integrity practices.
SoftWSP's firmware and hardware supply-chain assessments build the component-provenance and tamper-evidence baseline — SBOMs, vendor history, build-integrity checks — that an O-TTPS Part 1 requirement or Part 2 assessment expects a provider to produce as evidence: see device & firmware security.
This guide summarises ISO's and The Open Group's own published catalogue records, announcements and the freely available O-TTPS V1.1.1 text; it is not a substitute for the purchased ISO/IEC text or the current Open Group V1.2 publication, and does not constitute compliance or legal advice.
Sources
- ISO: ISO/IEC 20243-1:2023 — Information technology — Open Trusted Technology Provider™ Standard (O-TTPS) — Part 1: Requirements and recommendations for mitigating maliciously tainted and counterfeit products (catalogue record, current edition)
- ISO: ISO/IEC 20243-2:2023 — Part 2: Assessment procedures for the O-TTPS (catalogue record, current edition)
- ISO: ISO/IEC 20243-1:2018 — Part 1: Requirements and recommendations (catalogue record, withdrawn 2023-11-24)
- ISO: ISO/IEC 20243-2:2018 — Part 2: Assessment procedures for the O-TTPS and ISO/IEC 20243-1:2018 (catalogue record, withdrawn)
- The Open Group: O-TTPS Version 1.1.1, Part 1 — Requirements and Recommendations (free PDF, document C185-1, 17 September 2018, technically equivalent to ISO/IEC 20243-1:2018)
- The Open Group Blog: "Announcing Version 1.2 of the Open Trusted Technology Provider™ Standard (O-TTPS)" (5 September 2023)
- The Open Group: "The Open Trusted Technology Provider™ Standard (O-TTPS) Approved as ISO/IEC International Standard" (announcement, 1 September 2015)
- Wikipedia: "Open Trusted Technology Provider Standard" (secondary summary, for the OTTF/accreditation program history cross-check)
Frequently asked questions
What is ISO/IEC 20243?
ISO/IEC 20243, "Information technology — Open Trusted Technology Provider™ Standard (O-TTPS)," is an ISO/IEC JTC 1 International Standard for mitigating the risk of maliciously tainted and counterfeit products across a commercial off-the-shelf (COTS) ICT product's full life cycle — design, sourcing, build, fulfillment, distribution, sustainment and disposal. It originates from The Open Group's own O-TTPS standard, first published by The Open Group in April 2013 and approved as an ISO/IEC International Standard (ISO/IEC 20243:2015) on 1 September 2015.
What's the difference between Part 1 and Part 2?
Since the 2018 edition, ISO/IEC 20243 has been split into two parts. Part 1 ("Requirements and recommendations") sets the mandatory and recommended practices a provider follows to mitigate tainted and counterfeit product risk. Part 2 ("Assessment procedures for the O-TTPS") gives the procedures an assessor follows to check conformance against Part 1's mandatory requirements, stated in ISO's own abstract as intended to "ensure the repeatability, reproducibility, and objectivity of assessments." The Open Group's own documentation describes Part 2 as the basis for demonstrating conformance with the requirements in Part 1's Clause 6.
How current is each part, and what changed in the latest revision?
The current editions are ISO/IEC 20243-1:2023 and ISO/IEC 20243-2:2023, both published in November 2023, technically equivalent to The Open Group's O-TTPS Version 1.2 (announced 5 September 2023). The Open Group's own release notes describe that revision as clarifying several requirements, converting "multiple requirements that were previously recommendations" into mandatory requirements, and adding refined evidence examples to Part 2. The prior 2018 editions (equivalent to O-TTPS V1.1.1) were formally withdrawn on 24 November 2023. This guide did not independently read the 2023 edition's full requirements text (paywalled), so treat the exact clause-by-clause changes as to be confirmed against the purchased standard.
Is there a certification or accreditation program tied to this standard?
Yes. The Open Group operates the O-TTPS Accreditation Program, which it launched on 3 February 2014 as, per The Open Group's own description, one of the first accreditation programs aimed at assuring the integrity of COTS ICT products and the global supply chain. An organization assessed as conforming can be listed on The Open Group's public O-TTPS Accreditation Register and identify itself as an "Open Trusted Technology Provider." IBM was a founding OTTF member and an early accredited organization, for its Application Infrastructure and Middleware (AIM) software line.
Is the standard text freely available?
Part 1's O-TTPS-equivalent text (Version 1.1.1, technically equivalent to ISO/IEC 20243-1:2018) is published by The Open Group as a free download, document number C185-1, 43 pages, dated 17 September 2018, requiring only a site registration/login. The ISO/IEC-branded PDF of the current ISO/IEC 20243-1:2023 and -2:2023 editions, and any newer Open Group V1.2-equivalent free edition, sit behind ISO's and The Open Group's normal purchase paywalls; this guide has not independently confirmed whether a V1.2-equivalent free edition has since been published, so treat current free availability as to be confirmed against The Open Group's publications catalogue.
More guides
