https://korea-wg.openchainproject.org/en/tags/external-inquiry/Recent content in External Inquiry on OpenChain KWGHugoenhttps://korea-wg.openchainproject.org/en/guide/iso5230_guide/2-relevant-tasks/1-access/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/iso5230_guide/2-relevant-tasks/1-access/<h2 id="1-clause-overview">1. Clause Overview</h2> <p>Companies distributing software may receive inquiries from third parties (customers, open source copyright holders, researchers, etc.) regarding open source license compliance. Failure to respond to these inquiries in a timely manner risks escalation into copyright infringement disputes. §3.2.1 requires organizations to establish a publicly available means of contact for receiving external inquiries and to document a procedure internally for systematically responding to those inquiries. This clause requires both a public channel (Verification Material 3.2.1.1) and an internal response procedure (Verification Material 3.2.1.2).</p>https://korea-wg.openchainproject.org/en/guide/iso18974_guide/2-relevant-tasks/1-access/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/iso18974_guide/2-relevant-tasks/1-access/<h2 id="1-clause-overview">1. Clause Overview</h2> <p>§4.2.1 has the same structure as ISO/IEC 5230 §3.2.1 (External Inquiry Response), but the focus shifts from <strong>license compliance inquiries</strong> to <strong>vulnerability inquiries</strong>. A publicly visible channel must be established for third parties to make inquiries about known or newly discovered vulnerabilities in the supplied software, and an internal procedure for systematically handling these inquiries must be documented. Since the security vulnerability reporting channel is connected to the Coordinated Vulnerability Disclosure (CVD) procedure, a system for safely receiving and processing vulnerabilities discovered by security researchers or customers is required.</p>