Policy on OpenChain KWG

§3.1.1 Policy

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

A company without an Open Source Policy risks distributing software while developers are unaware of their open source license obligations. This can lead to serious legal and business risks, such as copyright infringement lawsuits, mandatory source code disclosure, and termination of business contracts. §3.1.1 requires organizations to establish a documented policy governing open source license compliance for supplied software and to communicate it so that all Program Participants within the organization are aware of the policy’s existence. This clause forms the foundation of the entire ISO/IEC 5230 program; all subsequent clauses (competence, processes, artifacts, etc.) operate on top of this policy.

§4.1.1 Policy

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

§4.1.1 corresponds to ISO/IEC 5230 §3.1.1 (License Compliance Policy), but the focus shifts to Security Assurance. A policy that systematically manages known and newly discovered vulnerabilities in open source components of the supplied software must be documented and communicated internally. The key difference from ISO/IEC 5230 §3.1.1 is the requirement for a periodic review process for the policy itself and its communication method. It is not enough to establish a policy; a review system must be in place to ensure the policy always remains valid and up to date.

Appendix

Mon, 01 Jan 0001 00:00:00 +0000

Appendix 1. Roster of Responsible Personnel

No	Role	Responsibility	Required competencies	Owning organization	Owner
1	Open Source Program Manager (OSPM)	Holds overall responsibility for the company’s open source program.	Understanding of the software development process Understanding of copyright and patents Expert knowledge of open source license compliance Communication skills	Open Source Management Team	[Name]
2	Legal	Assesses legal risks related to open source licenses and provides legal counsel.	Understanding of the open source ecosystem Expert knowledge of software copyright Expert knowledge of open source licenses Ability to assess legal risk	Legal Team	[Name]
3	IT	Operates and automates open source analysis tools.	Understanding of the open source license compliance process Understanding of open source analysis tools Expert knowledge of IT infrastructure Understanding of automation and CI/CD pipelines	IT Team	[Name]
4	Security	Operates open source security vulnerability analysis tools.	Understanding of DevSecOps Understanding of open source security vulnerability analysis tools Expert knowledge of known vulnerabilities and newly discovered vulnerabilities Ability to assess and manage risk	Security Team	[Name]
5	Development Culture	Supports in-house developers in actively using open source.	Understanding of the software development process Basic knowledge of open source license compliance Ability to design education and training Experience participating in open source communities	Development Team	[Name]
6	Quality	Verifies open source license obligations when distributing Supplied Software.	Understanding of the software development process Basic knowledge of open source license compliance Understanding of the open source policy Basic knowledge of open source licenses	Quality Assurance Team	[Name]
7	OSRB (Open Source Review Board)	Establishes and improves policies and processes for open source management.	Expert knowledge of open source policies and processes Experience operating a review board	OSRB	[Name]
8	OSPO (Open Source Program Office)	Supports contributions to external open source projects and the release of in-house projects as open source.	Experience participating in open source communities Ability to manage open source projects	OSPO	[Name]