This project aims to create a practical framework that helps manufacturers meet their due diligence obligations when using open source software, without adding burden to maintainers. By introducing voluntary security attestations, it seeks to strengthen FOSS security, sustainability, and collaboration with authorities and industry actors.