Update BR category to OSPS-BR-xxx numbering

baseline/OSPS-BR.yaml

@@ -8,7 +8,7 @@ description: |
   vulnerabilities or errors in the software distribution
   process.
 criteria:
-  - id: OSPS-BR-01
+  - id: OSPS-BR-101
     maturity_level: 1
     criterion: |
       The project's build and release pipelines
@@ -31,8 +31,54 @@ criteria:
       CSF: PR.AA-02
       OCRE: 483-813, 124-564, 357-352
     security_insights_value: # TODO
-
-  - id: OSPS-BR-02
+
+  - id: OSPS-BR-102
+    maturity_level: 1
+    criterion: |
+      Any websites and version control systems
+      involved in the project development
+      MUST be delivered using SSH,
+      HTTPS, or other encrypted channels.
+    rationale: |
+      Protect the confidentiality and integrity
+      of project source code during development,
+      reducing the risk of eavesdropping or data
+      tampering.
+    details: |
+      Configure the project's websites and version
+      control systems to use encrypted channels
+      such as SSH or HTTPS for data transmission.
+    control_mappings: 
+      BPB: B-B-11
+      CRA: 1.2d, 1.2e, 1.2f, 1.2i, 1.2j, 1.2k
+      SSDF: PO3.2, PS1
+      OCRE: 483-813, 124-564, 263-184
+    security_insights_value: # TODO
+
+  - id: OSPS-BR-103
+    maturity_level: 1
+    criterion: |
+      Any websites or other services involved in the
+      distribution of released software assets MUST
+      be delivered using HTTPS or other encrypted
+      channels.
+    rationale: |
+      Protect the confidentiality and integrity
+      of release assets consumed by the project's
+      users, reducing the risk of eavesdropping or
+      data tampering.
+    details: |
+      Configure the project's websites and
+      distribution services to use encrypted channels
+      such as HTTPS for data transmission.
+    control_mappings: 
+      BPB: B-B-11
+      CRA: 1.2d, 1.2e, 1.2f, 1.2i, 1.2j, 1.2k
+      SSDF: PO3.2, PS1
+      OCRE: 483-813, 124-564, 263-184
+    security_insights_value: # TODO
+
+  - id: OSPS-BR-201
     maturity_level: 2
     criterion: |
       All releases and released software assets
@@ -59,30 +105,7 @@ criteria:
       OCRE: 483-813, 124-564
     security_insights_value: # TODO
 
-  - id: OSPS-BR-03
-    maturity_level: 1
-    criterion: |
-      Any websites and version control systems
-      involved in the project development
-      MUST be delivered using SSH,
-      HTTPS, or other encrypted channels.
-    rationale: |
-      Protect the confidentiality and integrity
-      of project source code during development,
-      reducing the risk of eavesdropping or data
-      tampering.
-    details: |
-      Configure the project's websites and version
-      control systems to use encrypted channels
-      such as SSH or HTTPS for data transmission.
-    control_mappings: 
-      BPB: B-B-11
-      CRA: 1.2d, 1.2e, 1.2f, 1.2i, 1.2j, 1.2k
-      SSDF: PO3.2, PS1
-      OCRE: 483-813, 124-564, 263-184
-    security_insights_value: # TODO
-
-  - id: OSPS-BR-04
+  - id: OSPS-BR-202
     maturity_level: 2
     criterion: |
       All released software assets MUST be created
@@ -106,7 +129,7 @@ criteria:
       OCRE: 483-813, 124-564, 347-352, 263-184, 208-355
     security_insights_value: project-lifecycle.release-process
 
-  - id: OSPS-BR-05
+  - id: OSPS-BR-203
     maturity_level: 2
     criterion: |
       All build and release pipelines MUST use
@@ -133,7 +156,7 @@ criteria:
       OCRE: 483-813, 124-564, 347-352, 715-334
     security_insights_value: # TODO
 
-  - id: OSPS-BR-06
+  - id: OSPS-BR-204
     maturity_level: 2
     criterion: |
       All releases MUST provide a descriptive log
@@ -160,7 +183,7 @@ criteria:
       OCRE: 483-813, 124-564, 745-356
     security_insights_value: # TODO
 
-  - id: OSPS-BR-08
+  - id: OSPS-BR-205
     maturity_level: 2
     criterion: |
       All released software assets MUST be signed
@@ -184,30 +207,7 @@ criteria:
     security_insights_value: 
       Signed-Releases
 
-  - id: OSPS-BR-09
-    maturity_level: 1
-    criterion: |
-      Any websites or other services involved in the
-      distribution of released software assets MUST
-      be delivered using HTTPS or other encrypted
-      channels.
-    rationale: |
-      Protect the confidentiality and integrity
-      of release assets consumed by the project's
-      users, reducing the risk of eavesdropping or
-      data tampering.
-    details: |
-      Configure the project's websites and
-      distribution services to use encrypted channels
-      such as HTTPS for data transmission.
-    control_mappings: 
-      BPB: B-B-11
-      CRA: 1.2d, 1.2e, 1.2f, 1.2i, 1.2j, 1.2k
-      SSDF: PO3.2, PS1
-      OCRE: 483-813, 124-564, 263-184
-    security_insights_value: # TODO
-
-  - id: OSPS-BR-10
+  - id: OSPS-BR-206
     maturity_level: 2
     criterion: |
       Any websites, API responses or other