JR/T 0290-2024
Financial Industry Open Source Software Application Management Guide (English Version)

Standard No.: JR/T 0290-2024
Language: Chinese, Available in English version
Release Date: 2024
Published By: Professional Standard - Finance CN / JR
Latest: JR/T 0290-2024

Introduction

Analysis of the core architecture of the standard

Management dimension	Traditional model	Requirements of this standard	Improvement value
Organizational structure	Decentralized management	Decision-making + management dual teams	Responsibility clarity increased by 300%
Process control	Segmented management	Closed loop of the entire life cycle	Risk discovery efficiency increased by 5 times
Tool support	Manual records	Automated management platform	Management costs reduced by 60%

Key implementation points

Typical application scenario: Bank core system transformation

When a national commercial bank introduced the Apache Dubbo framework in its distributed system transformation, it strictly followed clause 7.2 of the standard:

The technical team completed the architecture adaptability assessment
The security department scanned for the CVE-2022-39135 vulnerability
Legal confirmed the compliance of the Apache 2.0 license

Advanced risk management solution

Risk type	Detection frequency	Disposal time limit	Tool recommendations
License changes	Quarterly scans	15 working days	FOSSology
High-risk vulnerabilities	Real-time monitoring	72 hours	Black Duck

Tool implementation path

Referring to Chapter 10 of the standard, it is recommended to build in three stages:

Primary stage: Establish a product warehouse (Artifactory/Nexus)
Intermediate stage: Deploy SCA tools (Checkmarx/Synopsys)
Advanced stage: Build a unified management platform

JR/T 0290-2024 Referenced Document

GB/T 28458-2020 Information security technology—Cybersecurity vulnerability identification and description specification
GB/T 30276-2020 Information security technology—Specification for cybersecurity vulnerability management
GB/T 30279-2020 Information security technology—Guidelines for categorization and classification of cybersecurity vulnerability
JR/T 0289-2024 Open Source Technology for the Financial Industry Terminology
JR/T 0291-2024 Financial Industry Open Source Software Application Evaluation Standards