§3.1.2 Competence

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

For an open source program to actually function, the people assigned to relevant roles must have the competence to perform those roles. If roles and responsibilities are only written in documents and the people responsible have no basic knowledge of open source license or security vulnerability management, the policies and processes will be nominal. §3.1.2 requires the organization to identify the roles involved in the program, define the competence required for each role, evaluate and record whether participants actually possess that competence. This clause advances the role structure defined in §3.1.1 Policy into a concrete competence framework.

§4.1.2 Competence

Mon, 01 Jan 0001 00:00:00 +0000

★ 18974 Exclusive Items — Documented Evidence Strength

§4.1.2.3·§4.1.2.5·§4.1.2.6 are ISO 18974 exclusive (★) items requiring Documented Evidence. A simple procedure document is insufficient — you must retain actual execution records (participant list, review meeting minutes, internal best practice comparison results). For a detailed explanation of the strength difference, see §4.1.5 Standard Practices — Documented Evidence Notice.

1. Clause Overview

§4.1.2 has the same basic structure as ISO/IEC 5230 §3.1.2 (Competence), but requires 3 additional Verification Material items. While 5230 requires three items — a list of roles, a definition of competencies per role, and evidence of competency assessment — 18974 additionally requires a list of participants and their role mappings (4.1.2.3), evidence of periodic review and process changes (4.1.2.5), and verification of alignment with internal best practices (4.1.2.6). These three additional items require demonstrating that the competence framework is not merely formal, but is actively kept up to date and aligned with industry standards.

Competence on OpenChain KWG

§3.1.2 Competence

1. Clause Overview

§4.1.2 Competence

1. Clause Overview