ISO/IEC 5230 on OpenChain KWG

§3.1 Program Foundation

Mon, 01 Jan 0001 00:00:00 +0000

§3.1.1 Policy

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

A company without an Open Source Policy risks distributing software while developers are unaware of their open source license obligations. This can lead to serious legal and business risks, such as copyright infringement lawsuits, mandatory source code disclosure, and termination of business contracts. §3.1.1 requires organizations to establish a documented policy governing open source license compliance for supplied software and to communicate it so that all Program Participants within the organization are aware of the policy’s existence. This clause forms the foundation of the entire ISO/IEC 5230 program; all subsequent clauses (competence, processes, artifacts, etc.) operate on top of this policy.

§3.2.1 External Inquiry Response

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

Companies distributing software may receive inquiries from third parties (customers, open source copyright holders, researchers, etc.) regarding open source license compliance. Failure to respond to these inquiries in a timely manner risks escalation into copyright infringement disputes. §3.2.1 requires organizations to establish a publicly available means of contact for receiving external inquiries and to document a procedure internally for systematically responding to those inquiries. This clause requires both a public channel (Verification Material 3.2.1.1) and an internal response procedure (Verification Material 3.2.1.2).

§3.3.1 SBOM

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

Without knowing what open source components are included in the supplied software, it is impossible to fulfill license obligations or respond to security vulnerabilities. §3.3.1 requires the establishment of a procedure for identifying, tracking, reviewing, approving, and archiving the open source components that make up supplied software, and maintaining component records (SBOM) that demonstrate the procedure has actually been followed. This clause forms the foundation for operating the SBOM, which is the core infrastructure of open source license compliance and Security Assurance.

§3.4.1 Artifacts

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

To fulfill license obligations, Compliance Artifacts such as notices and source code packages must actually be prepared and provided with the software. §3.4.1 requires the establishment of a procedure for preparing the Compliance Artifacts required by the identified licenses and distributing them with the supplied software, as well as a procedure for retaining copies of the artifacts for a certain period. This clause connects the results of the §3.3 review and approval stage to actual distribution and archiving.

§3.5.1 Contributions

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

Many companies contribute code, documentation, bug reports, and more to external open source projects. Contribution activities build community trust and expand technical influence, but they also carry the risk of unintentionally disclosing company code or patents. §3.5.1 requires organizations that allow external open source contributions to establish a documented policy and procedure governing contributions, and to ensure that Program Participants are aware of their existence. This clause does not apply to organizations that do not allow contributions, but if they do, all three verification materials must be in place.

§3.6.1 Conformance

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

To receive official recognition of ISO/IEC 5230 conformance, the program defined in §3.1.4 must be confirmed in a document as satisfying all requirements of this specification. §3.6.1 is the stage for officially affirming that all clauses from §3.1 through §3.5 have been satisfied. This clause is the final confirmation procedure that completes adherence to the specification, requiring the organization’s official confirmation that the program satisfies all requirements of ISO/IEC 5230:2020 version 2.1.

0. Exploring OpenChain

Mon, 01 Jan 0001 00:00:00 +0000

1. What is the OpenChain Project?

Software today is growing ever larger and more complex. Developing a single piece of software may involve not only internally developed code but also open source, third-party software, vendor SDKs, and a wide variety of software across the software supply chain.

If even one organization in this complex software supply chain fails to comply with open source license obligations or does not provide accurate open source information, the company ultimately distributing the software will inevitably fail to meet its open source license compliance obligations. This can lead to lawsuits and the suspension of product sales.

§3.1.2 Competence

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

For an open source program to actually function, the people assigned to relevant roles must have the competence to perform those roles. If roles and responsibilities are only written in documents and the people responsible have no basic knowledge of open source license or security vulnerability management, the policies and processes will be nominal. §3.1.2 requires the organization to identify the roles involved in the program, define the competence required for each role, evaluate and record whether participants actually possess that competence. This clause advances the role structure defined in §3.1.1 Policy into a concrete competence framework.

§3.2 Relevant Tasks

Mon, 01 Jan 0001 00:00:00 +0000

§3.2.2 Effective Resources

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

For an open source program to actually function, it is not enough to just define roles. Actual personnel must be assigned to each role, and sufficient time and budget must be provided to carry out the work. §3.2.2 requires organizations to document the persons responsible for each program role, confirm that staffing and budget are appropriately allocated, and to have a method for accessing legal expertise, a procedure for assigning internal responsibilities, and a procedure for handling non-compliance cases. This clause consists of five verification material items and is the stage that implements the role structure defined in §3.1 Program Foundation into an actual operational framework.

§3.3.2 License Compliance

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

License obligations for open source components vary depending on the distribution format (binary, source code), whether modifications were made, and how they are combined with other components. §3.3.2 requires the program to have the capability to handle the common open source license use cases for open source components in the supplied software. This clause goes beyond simply identifying licenses to establishing procedures that define how to fulfill obligations for various distribution scenarios.

§3.6.2 Duration

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

ISO/IEC 5230 conformance does not remain valid indefinitely once obtained. When a new version of the specification is published, a program that was conformant against the previous version retains its conformance for only 18 months after the new version is published. §3.6.2 requires organizations to maintain a document confirming that the program meets all requirements of the specification within the past 18 months of obtaining conformance. This clause serves as a mechanism to ensure that open source compliance programs remain continuously operational rather than stopping at formal certification.

ISO/IEC 5230 Conformance Guide

Mon, 01 Jan 0001 00:00:00 +0000

This guide walks through each requirement clause of ISO/IEC 5230 (OpenChain License Compliance) one by one. It explains what verification materials each clause requires, how to comply, and what sample documents can be used directly.

Author : OpenChain Korea Work Group / CC BY 4.0

Target Audience

Open source compliance officers and open source program managers
Personnel at companies preparing for ISO/IEC 5230 certification
Practitioners who want to review their existing open source management framework against ISO standards

How to Use This Guide

Relationship with the Enterprise Open Source Management Guide

The Enterprise Open Source Management Guide explains how to implement open source management in practice (policies, processes, tools, and organization).

This guide (ISO/IEC 5230 Conformance Guide) organizes, clause by clause, what must be demonstrated for certification.

Guide	Focus	When to Use
Enterprise Open Source Management Guide	Practical implementation (How to implement)	When building an open source management framework from scratch
ISO/IEC 5230 Conformance Guide	Verification material criteria by clause (What to prove)	When preparing for certification or conducting a self-assessment

The two guides are complementary. Each clause page provides cross-links to the corresponding section of the Enterprise Open Source Management Guide.

25th Meeting

Mon, 01 Jan 0001 00:00:00 +0000

Schedule

Schedule: 2025-03-25 (Tue) 2:00 PM - 5:00 PM
Location: Korea Digital Certification Association (Yeouido Park One Building Tower 2, 48th floor) - https://maps.app.goo.gl/YnxTkz8LjHPXFJBv6

Agenda

Time	Agenda	Speaker	Slide
14:00~14:10	Welcome & Opening	-	-
14:10~14:30	OpenChain Global Update	Shane Coughlan, Linux Foundation	pptx
14:30~14:50	OpenChain Korea Update	Haksung Jang, SK Telecom	slide
14:50~15:00	Lightning Talk 1 - Open Source Tech Day 2025 Announcement	- Jeong-sook Par, ETRI	pdf
15:00~15:30	Mobile ID application “DID”, open source governance strategy and future tasks?	Mikyoung Lee, Raon Secure	pdf
15:30~16:00	Networking	All	-
16:00~16:30	ISO/IEC 5230:2020 Conformance in KFTC	Daeyeol Ryu, KFTC	pdf(ko)
16:30~17:00	Lightning Talk 2 - 2024 Open Source Settlement that Developers Should Know - Expansion of Open Source User Rights and Importance of Providing LGPL-2.1 Installation Information as Seen in the AVM Litigation - ISO/IEC 18974 Corporate Introduction and Certification Strategy	- Seo-yeon Lee, Line Plus - Haksung Jang, SK Telecom	pdf AVM소송소개 ISO/IEC18974

28th Meeting

Mon, 01 Jan 0001 00:00:00 +0000

Schedule

Date and Time: December 9, 2025 (Tuesday), 2:00 PM – 4:50 PM
Venue: Hancom Tower (Pangyo - https://maps.app.goo.gl/Nq3XHZtPrg9Zvtzn7)

Agenda

Time	Agenda	Speaker	Slide
14:00~14:05	Welcome & Opening	Jihwan Jeong CTO, Hancom	-
14:05~14:20	OpenChain Update	Haksung Jang, SK Telecom	slide
14:20~14:45	Sharing Hancom’s OpenChain Certification Declaration Preparation	Hyunjoo Ryu, Hancom	pdf
14:45~15:10	Introduction to OpenPDF Data Loader and Tips for Open Source Disclosure Using AI	Bundo Lee, Hancom	pdf
15:10~15:50	Networking (Group Discussion)	All	-
15:50~16:00	Telechips’ OpenChain Certification and Remaining Challenges	Jiyoung Yeon, Telechips	pdf
16:00~16:10	About Cryptography Bill of Materials (CBOM)	Jinyoung Chae, Samsung SDS	-
16:10~16:25	Tooling & Legal Group Major Activities and Review	Wonjae Park, LG Electronics	-
16:25~16:50	2025 Review & Awards	Darae Ahn, Samsung Electronics	slide

§3.1.3 Awareness

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

Even participants with the right roles and competencies will only participate in a perfunctory manner if they do not understand the purpose of the open source program and the meaning of their own contribution to the overall compliance framework. §3.1.3 requires the organization to evaluate and record that Program Participants actually understand the program’s objectives, how they contribute, and the consequences of failing to follow the program’s requirements. This clause is the next step after §3.1.2 Competence (possessing knowledge and skills), forming the practical motivation by connecting the competence participants hold to the program’s purpose.

§3.3 Content Review and Approval

Mon, 01 Jan 0001 00:00:00 +0000

§3.1.4 Program Scope

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

If it is unclear whether the open source program applies to the entire organization or only to specific product lines or business units, the boundaries of compliance activities become vague and accountability becomes unclear. §3.1.4 requires a documented written statement that clearly defines which software, organizational units, and distribution channels the open source program applies to, and what is outside the scope. The scope may vary depending on the organization’s size and business model, and this clause requires that choice to be explicitly recorded.

§3.4 Compliance Artifacts

Mon, 01 Jan 0001 00:00:00 +0000

§3.1.5 License Obligations

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

The most critical task when including open source components in software is accurately understanding the obligations, restrictions, and rights imposed by the licenses applied to those components. Distributing without reviewing license obligations can result in serious legal risks such as mandatory source code disclosure, missing copyright notices, and patent clause violations. §3.1.5 requires the establishment of a procedure for reviewing all identified licenses to determine their obligations, restrictions, and rights, and for recording the results. This procedure forms the foundation of the §3.3.2 License Compliance process.

§3.5 Community Engagement

Mon, 01 Jan 0001 00:00:00 +0000

ISO/IEC 5230 vs 18974 Comparison

Mon, 01 Jan 0001 00:00:00 +0000

1. Relationship Between the Two Standards

ISO/IEC 5230 and ISO/IEC 18974 are both international open source standards led by the OpenChain Project, but they address different problems. 5230 covers open source license compliance (fulfillment of copyright obligations, SBOM management, and distribution of Compliance Artifacts), while 18974 covers open source security assurance (vulnerability detection, assessment, response, and CVD). The two standards do not have a complete superset/subset relationship. They share 9 common clauses covering policy, competence, SBOM, and similar areas, but each has its own exclusive clauses — 5230 has clauses for license compliance, artifacts, and contributions, while 18974 has clauses for Standard Practice Implementation and Security Assurance.

§3.6 Adherence to the Specification

Mon, 01 Jan 0001 00:00:00 +0000

2024-12-13 ISO 5230과 ISO 18974가 법률 전문가에게 미치는 영향과 2024년 전망

Fri, 13 Dec 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/12/04/webinar-enabling-sboms-across-the-linux-foundation

1. 발표자 소개

이번 웨비나의 발표자는 OpenChain 프로젝트의 주요 멤버로, 오픈소스 라이선스 준수 및 보안 표준화에 깊은 전문성을 가진 전문가입니다. 그는 ISO/IEC 5230:2020 및 ISO/IEC 18974:2023 표준 개발 과정에 직접 참여했으며, 관련 법률 및 산업적 적용에 대한 풍부한 경험을 보유하고 있습니다.

2. 웨비나 소개와 목적

이 웨비나는 ISO/IEC 5230(오픈소스 라이선스 준수)와 ISO/IEC 18974(오픈소스 보안 보증)가 법률 전문가들에게 미칠 영향을 중심으로 진행되었습니다. 특히, 2024년을 기준으로 이 표준들이 기업의 조달 협상, 인수합병(M&A), 공급망 관리에 어떤 변화를 가져올지에 대해 다루었습니다.

2024-12-04 OpenChain ISO 표준이 InnerSource를 지원하는 방법 이해하기

Wed, 04 Dec 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/12/04/full-recording-understanding-how-openchain-iso-iec-5230-and-iso-iec-18974-support-innersource-innersource-commons-summit-2024

1. 발표자 소개

Shane Coughlan은 OpenChain Project의 General Manager로, 오픈소스 표준화와 관련된 글로벌 리더십을 제공하고 있습니다. 그는 오픈소스 생태계에서의 라이선스 준수 및 보안 보증을 위한 국제 표준 개발에 주력하며, InnerSource와 같은 새로운 소프트웨어 개발 방식에도 이를 적용하는 방법을 모색하고 있습니다.

2. 웨비나 소개와 목적

이번 웨비나는 InnerSource Commons Summit 2024에서 진행된 세션으로, OpenChain ISO/IEC 5230(오픈소스 라이선스 준수 국제 표준)와 ISO/IEC 18974(오픈소스 보안 보증 국제 표준)가 InnerSource 프로그램에 어떻게 기여할 수 있는지를 다룹니다.

ISO Standard, OpenChain

Wed, 16 Dec 2020 00:00:00 +0000

On December 15, 2020, OpenChain Specification 2.1 was officially published as an international standard ISO/IEC 5230:2020.

For more information on this, please refer to the following article. : https://world.einnews.com/pr_news/532725924/iso-iec-5230-2020-is-the-international-standard-for-open-source-compliance

ISO/IEC 5230 on OpenChain KWG

§3.1 Program Foundation

§3.1.1 Policy

1. Clause Overview

§3.2.1 External Inquiry Response

1. Clause Overview

§3.3.1 SBOM

1. Clause Overview

§3.4.1 Artifacts

1. Clause Overview

§3.5.1 Contributions

1. Clause Overview

§3.6.1 Conformance

1. Clause Overview

0. Exploring OpenChain

1. What is the OpenChain Project?

§3.1.2 Competence

1. Clause Overview

§3.2 Relevant Tasks

§3.2.2 Effective Resources

1. Clause Overview

§3.3.2 License Compliance

1. Clause Overview

§3.6.2 Duration

1. Clause Overview

ISO/IEC 5230 Conformance Guide

Target Audience

How to Use This Guide

25th Meeting

Schedule

Agenda

Sponsor

28th Meeting

Schedule

Agenda

Sponsor

§3.1.3 Awareness

1. Clause Overview

§3.3 Content Review and Approval

§3.1.4 Program Scope

1. Clause Overview

§3.4 Compliance Artifacts

§3.1.5 License Obligations

1. Clause Overview

§3.5 Community Engagement

ISO/IEC 5230 vs 18974 Comparison

1. Relationship Between the Two Standards

§3.6 Adherence to the Specification

2024-12-13 ISO 5230과 ISO 18974가 법률 전문가에게 미치는 영향과 2024년 전망

목차

1. 발표자 소개

2. 웨비나 소개와 목적

2024-12-04 OpenChain ISO 표준이 InnerSource를 지원하는 방법 이해하기

목차

1. 발표자 소개

2. 웨비나 소개와 목적

ISO Standard, OpenChain