Content Security Policy CSP 3 is being specified in index.bs (published at https://www.w3.org/TR/CSP3/) CSP 2 is published as a CR at https://www.w3.org/TR/CSP2/. CSP 1 is published as a Note at https://www.w3.org/TR/2012/CR-CSP-20121115/