ISO/IEC 18974 on OpenChain KWG

§4.1 Program Foundation

Mon, 01 Jan 0001 00:00:00 +0000

§4.1.1 Policy

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

§4.1.1 corresponds to ISO/IEC 5230 §3.1.1 (License Compliance Policy), but the focus shifts to Security Assurance. A policy that systematically manages known and newly discovered vulnerabilities in open source components of the supplied software must be documented and communicated internally. The key difference from ISO/IEC 5230 §3.1.1 is the requirement for a periodic review process for the policy itself and its communication method. It is not enough to establish a policy; a review system must be in place to ensure the policy always remains valid and up to date.

§4.2.1 Access

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

§4.2.1 has the same structure as ISO/IEC 5230 §3.2.1 (External Inquiry Response), but the focus shifts from license compliance inquiries to vulnerability inquiries. A publicly visible channel must be established for third parties to make inquiries about known or newly discovered vulnerabilities in the supplied software, and an internal procedure for systematically handling these inquiries must be documented. Since the security vulnerability reporting channel is connected to the Coordinated Vulnerability Disclosure (CVD) procedure, a system for safely receiving and processing vulnerabilities discovered by security researchers or customers is required.

§4.3.1 SBOM

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

§4.3.1 has the same basic structure as ISO/IEC 5230 §3.3.1 (SBOM), but the emphasis differs. While 5230 covers the SBOM for license management of open source components, §4.3.1 of 18974 emphasizes continuously recording and retaining the SBOM throughout the entire software lifecycle. In particular, the SBOM must be maintained even after deployment so it can be integrated with the vulnerability monitoring in §4.3.2 Security Assurance. Without an SBOM, post-deployment impact analysis for newly published CVEs (§4.1.5 Method 5) cannot be performed.

§4.4.1 Completeness

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

§4.4.1 corresponds to ISO/IEC 5230 §3.6.1 (Conformance). A document must be prepared affirming that the program defined in §4.1.4 satisfies all requirements of ISO/IEC 18974. The structure is the same as 5230 §3.6.1, but the difference is that the subject of confirmation covers all 25 Verification Material items of 18974. When preparing for ISO/IEC 5230 and 18974 certification simultaneously, it is efficient to conduct an integrated review of the common items of both standards and then additionally confirm the 9 items exclusive to 18974 (marked with ★).

0. Exploring OpenChain

Mon, 01 Jan 0001 00:00:00 +0000

1. What is the OpenChain Project?

Software today is growing ever larger and more complex. Developing a single piece of software may involve not only internally developed code but also open source, third-party software, vendor SDKs, and a wide variety of software across the software supply chain.

If even one organization in this complex software supply chain fails to comply with open source license obligations or does not provide accurate open source information, the company ultimately distributing the software will inevitably fail to meet its open source license compliance obligations. This can lead to lawsuits and the suspension of product sales.

§4.1.2 Competence

Mon, 01 Jan 0001 00:00:00 +0000

★ 18974 Exclusive Items — Documented Evidence Strength

§4.1.2.3·§4.1.2.5·§4.1.2.6 are ISO 18974 exclusive (★) items requiring Documented Evidence. A simple procedure document is insufficient — you must retain actual execution records (participant list, review meeting minutes, internal best practice comparison results). For a detailed explanation of the strength difference, see §4.1.5 Standard Practices — Documented Evidence Notice.

1. Clause Overview

§4.1.2 has the same basic structure as ISO/IEC 5230 §3.1.2 (Competence), but requires 3 additional Verification Material items. While 5230 requires three items — a list of roles, a definition of competencies per role, and evidence of competency assessment — 18974 additionally requires a list of participants and their role mappings (4.1.2.3), evidence of periodic review and process changes (4.1.2.5), and verification of alignment with internal best practices (4.1.2.6). These three additional items require demonstrating that the competence framework is not merely formal, but is actively kept up to date and aligned with industry standards.

§4.2 Relevant Tasks

Mon, 01 Jan 0001 00:00:00 +0000

§4.2.2 Effectively Resourced

Mon, 01 Jan 0001 00:00:00 +0000

★ 18974 Exclusive Items — Documented Evidence Strength

§4.2.2.3 is an ISO 18974 exclusive (★) item requiring Documented Evidence. The method for accessing vulnerability resolution resources is not merely a procedure document — you must retain actual resource utilization records (security advisory contracts, account issuance records, access logs). For a detailed explanation of the strength difference, see §4.1.5 Standard Practices — Documented Evidence Notice.

1. Clause Overview

§4.2.2 corresponds to ISO/IEC 5230 §3.2.2 (Effectively Resourced) but has two key differences. First, while 5230 requires 5 Verification Materials, 18974 requires 4. The §3.2.2.5 item from 5230 (procedure for reviewing and correcting non-compliance cases) is absorbed into §4.1.5 Standard Practice Implementation in 18974. Second, §3.2.2.3 (method for accessing legal expertise) is replaced in §4.2.2.3 by vulnerability resolution expertise. Rather than legal expertise for license matters, the organization must secure technical and security expertise capable of actually resolving known vulnerabilities and document how that expertise is accessed.

§4.3.2 Security Assurance

Mon, 01 Jan 0001 00:00:00 +0000

★ 18974 Exclusive Items — Documented Evidence Strength

§4.3.2.1·§4.3.2.2 are ISO 18974 exclusive (★) items requiring Documented Evidence. Not merely a “vulnerability response procedure document,” but actual execution records for each CVE (scan results, CVSS scores, remediation history, VEX issuance, customer notification history) must be retained. For a detailed explanation of the strength difference, see §4.1.5 Standard Practices — Documented Evidence Notice.

1. Clause Overview

§4.3.2 is the core clause of ISO/IEC 18974 and is a new clause exclusive to 18974 that does not exist in ISO/IEC 5230. It requires establishing a procedure covering the entire process — vulnerability detection → risk assessment → remediation decision → customer consent (where applicable) → remediation → post-deployment newly disclosed vulnerability response → continuous monitoring — for each open source component in the SBOM, and maintaining implementation records. If §4.1.5 requires the existence of vulnerability handling methods, §4.3.2 requires that those methods have actually been applied to each component with records retained.

§4.4.2 Duration

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

§4.4.2 has the same structure as ISO/IEC 5230 §3.6.2 (Duration). It requires organizations to maintain a retrospective document confirming that all requirements of the specification have been met during the past 18 months of obtaining conformance (this is a past-fact confirmation, not a future commitment). When a new version of the specification is published, conformance under the previous version is maintained for a grace period of 18 months, during which it is recommended to update to the latest version.

25th Meeting

Mon, 01 Jan 0001 00:00:00 +0000

Schedule

Schedule: 2025-03-25 (Tue) 2:00 PM - 5:00 PM
Location: Korea Digital Certification Association (Yeouido Park One Building Tower 2, 48th floor) - https://maps.app.goo.gl/YnxTkz8LjHPXFJBv6

Agenda

Time	Agenda	Speaker	Slide
14:00~14:10	Welcome & Opening	-	-
14:10~14:30	OpenChain Global Update	Shane Coughlan, Linux Foundation	pptx
14:30~14:50	OpenChain Korea Update	Haksung Jang, SK Telecom	slide
14:50~15:00	Lightning Talk 1 - Open Source Tech Day 2025 Announcement	- Jeong-sook Par, ETRI	pdf
15:00~15:30	Mobile ID application “DID”, open source governance strategy and future tasks?	Mikyoung Lee, Raon Secure	pdf
15:30~16:00	Networking	All	-
16:00~16:30	ISO/IEC 5230:2020 Conformance in KFTC	Daeyeol Ryu, KFTC	pdf(ko)
16:30~17:00	Lightning Talk 2 - 2024 Open Source Settlement that Developers Should Know - Expansion of Open Source User Rights and Importance of Providing LGPL-2.1 Installation Information as Seen in the AVM Litigation - ISO/IEC 18974 Corporate Introduction and Certification Strategy	- Seo-yeon Lee, Line Plus - Haksung Jang, SK Telecom	pdf AVM소송소개 ISO/IEC18974

§4.1.3 Awareness

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

§4.1.3 has the same Verification Material structure as ISO/IEC 5230 §3.1.3 (Awareness). It requires that awareness of program objectives, how individuals contribute to the program, and the implications of non-compliance be assessed and recorded for Program Participants. The difference from 5230 is that the focus of the awareness assessment shifts to Security Assurance. Participants must be aware not only of license compliance but also of the vulnerability management process, CVD procedures, and CVSS-based response criteria.

§4.3 Content Review and Approval

Mon, 01 Jan 0001 00:00:00 +0000

ISO/IEC 18974 Conformance Guide

Mon, 01 Jan 0001 00:00:00 +0000

This guide explains each requirement clause of ISO/IEC 18974 (OpenChain Security Assurance) one by one. It describes what Verification Materials each clause requires, how to comply, and what sample documents can be used immediately.

Author : OpenChain Korea Work Group / CC BY 4.0

Target Audience

Security managers and open source program managers at organizations establishing an open source security assurance framework for the first time
Engineers building open source vulnerability management processes in DevSecOps environments
Organization staff preparing to add ISO/IEC 18974 certification after obtaining ISO/IEC 5230 certification

Relationship with ISO/IEC 5230

ISO/IEC 18974 adds a security layer on top of ISO/IEC 5230

ISO/IEC 5230 (License Compliance) covers the foundational program for systematically managing open source license obligations.

ISO/IEC 18974 (Security Assurance) adds a security layer of vulnerability detection, assessment, and response on top of that foundation. The two standards share core infrastructure such as policy, competence, and SBOM, and 18974 extends and deepens this from a security perspective.

Category	ISO/IEC 5230	ISO/IEC 18974
Purpose	License Compliance	Security Assurance
Verification Materials	24 items	25 items
Common Foundation Clauses	—	16 (corresponding to 5230)
18974-Exclusive Clauses	—	9 (security-specific)
Key Additional Elements	—	Vulnerability detection, response, and CVD procedures

§4.1.4 Program Scope

Mon, 01 Jan 0001 00:00:00 +0000

★ 18974 Exclusive Items — Documented Evidence Strength

§4.1.4.2·§4.1.4.3 are ISO 18974 exclusive (★) items requiring Documented Evidence. Metrics must include actual measurement data; continuous improvement must retain review/audit meeting minutes. For a detailed explanation of the strength difference, see §4.1.5 Standard Practices — Documented Evidence Notice.

1. Clause Overview

§4.1.4 is the clause from ISO/IEC 5230 §3.1.4 (Program Scope) with 2 additional Verification Materials. While 5230 only requires a written statement that clearly defines the program’s scope, 18974 additionally requires a set of performance metrics the program seeks to improve upon (4.1.4.2) and documented evidence from each review, update, or audit demonstrating continuous improvement (4.1.4.3). These two items are intended to demonstrate that the security assurance program is not static compliance, but a system with measurable goals that continuously improves.

§4.4 Conformance

Mon, 01 Jan 0001 00:00:00 +0000

§4.1.5 Standard Practice Implementation

Mon, 01 Jan 0001 00:00:00 +0000

Evidence Strength for ISO 18974 Exclusive (★) Items — Documented Evidence

Unlike ISO/IEC 5230, ISO/IEC 18974 requires “Documented Evidence” for its 9 exclusive items (★: §4.1.2.3·4.1.2.5·4.1.2.6·4.1.4.2·4.1.4.3·§4.1.5.1·4.2.2.3·4.3.2.1·4.3.2.2). This is a stronger evidence level than the documented procedure or document required for general items.

Strength	ISO Expression	Compliance Level	Certification Audit
Weak	`document`	Artifact existence	Format review
Medium	`documented procedure`	Documented procedure + intent to follow	Procedure body review
Strong	`Documented Evidence`	Procedure + records of actual execution (evidence pack)	Verification of actual execution evidence: logs, tickets, issue tracking results, etc.

§4.1.5.1 requires not merely “procedure documents” for each of the 8 methods, but also records of activities actually performed (scan logs, tickets, approval history, VEX issuance records, etc.) to pass certification.

ISO/IEC 5230 vs 18974 Comparison

Mon, 01 Jan 0001 00:00:00 +0000

1. Relationship Between the Two Standards

ISO/IEC 5230 and ISO/IEC 18974 are both international open source standards led by the OpenChain Project, but they address different problems. 5230 covers open source license compliance (fulfillment of copyright obligations, SBOM management, and distribution of Compliance Artifacts), while 18974 covers open source security assurance (vulnerability detection, assessment, response, and CVD). The two standards do not have a complete superset/subset relationship. They share 9 common clauses covering policy, competence, SBOM, and similar areas, but each has its own exclusive clauses — 5230 has clauses for license compliance, artifacts, and contributions, while 18974 has clauses for Standard Practice Implementation and Security Assurance.

2024-12-13 ISO 5230과 ISO 18974가 법률 전문가에게 미치는 영향과 2024년 전망

Fri, 13 Dec 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/12/04/webinar-enabling-sboms-across-the-linux-foundation

1. 발표자 소개

이번 웨비나의 발표자는 OpenChain 프로젝트의 주요 멤버로, 오픈소스 라이선스 준수 및 보안 표준화에 깊은 전문성을 가진 전문가입니다. 그는 ISO/IEC 5230:2020 및 ISO/IEC 18974:2023 표준 개발 과정에 직접 참여했으며, 관련 법률 및 산업적 적용에 대한 풍부한 경험을 보유하고 있습니다.

2. 웨비나 소개와 목적

이 웨비나는 ISO/IEC 5230(오픈소스 라이선스 준수)와 ISO/IEC 18974(오픈소스 보안 보증)가 법률 전문가들에게 미칠 영향을 중심으로 진행되었습니다. 특히, 2024년을 기준으로 이 표준들이 기업의 조달 협상, 인수합병(M&A), 공급망 관리에 어떤 변화를 가져올지에 대해 다루었습니다.

2024-12-04 OpenChain ISO 표준이 InnerSource를 지원하는 방법 이해하기

Wed, 04 Dec 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/12/04/full-recording-understanding-how-openchain-iso-iec-5230-and-iso-iec-18974-support-innersource-innersource-commons-summit-2024

1. 발표자 소개

Shane Coughlan은 OpenChain Project의 General Manager로, 오픈소스 표준화와 관련된 글로벌 리더십을 제공하고 있습니다. 그는 오픈소스 생태계에서의 라이선스 준수 및 보안 보증을 위한 국제 표준 개발에 주력하며, InnerSource와 같은 새로운 소프트웨어 개발 방식에도 이를 적용하는 방법을 모색하고 있습니다.

2. 웨비나 소개와 목적

이번 웨비나는 InnerSource Commons Summit 2024에서 진행된 세션으로, OpenChain ISO/IEC 5230(오픈소스 라이선스 준수 국제 표준)와 ISO/IEC 18974(오픈소스 보안 보증 국제 표준)가 InnerSource 프로그램에 어떻게 기여할 수 있는지를 다룹니다.

ISO/IEC 18974 on OpenChain KWG

§4.1 Program Foundation

§4.1.1 Policy

1. Clause Overview

§4.2.1 Access

1. Clause Overview

§4.3.1 SBOM

1. Clause Overview

§4.4.1 Completeness

1. Clause Overview

0. Exploring OpenChain

1. What is the OpenChain Project?

§4.1.2 Competence

1. Clause Overview

§4.2 Relevant Tasks

§4.2.2 Effectively Resourced

1. Clause Overview

§4.3.2 Security Assurance

1. Clause Overview

§4.4.2 Duration

1. Clause Overview

25th Meeting

Schedule

Agenda

Sponsor

§4.1.3 Awareness

1. Clause Overview

§4.3 Content Review and Approval

ISO/IEC 18974 Conformance Guide

Target Audience

Relationship with ISO/IEC 5230

§4.1.4 Program Scope

1. Clause Overview

§4.4 Conformance

§4.1.5 Standard Practice Implementation

ISO/IEC 5230 vs 18974 Comparison

1. Relationship Between the Two Standards

2024-12-13 ISO 5230과 ISO 18974가 법률 전문가에게 미치는 영향과 2024년 전망

목차

1. 발표자 소개

2. 웨비나 소개와 목적

2024-12-04 OpenChain ISO 표준이 InnerSource를 지원하는 방법 이해하기

목차

1. 발표자 소개

2. 웨비나 소개와 목적