Two years later: a baseline that drives up security for the industry

Google outlines updates to the Minimum Viable Secure Product (MVSP) controls, including expanded vulnerability reporting guidance and supply chain security practices informed by SLSA, alongside growth of the MVSP working group. The post highlights measurable benefits from integrating MVSP into Google’s third‑party lifecycle (e.g., a 68% reduction in assessment time) and notes ongoing challenges, such as 48% of third parties failing two or more controls. It calls on the industry to adopt MVSP to raise the baseline for application security and streamline procurement, assessment, and contracting.