https://korea-wg.openchainproject.org/en/tags/program-scope/Recent content in Program Scope on OpenChain KWGHugoenhttps://korea-wg.openchainproject.org/en/guide/iso5230_guide/1-program-foundation/4-scope/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/iso5230_guide/1-program-foundation/4-scope/<h2 id="1-clause-overview">1. Clause Overview</h2> <p>If it is unclear whether the open source program applies to the entire organization or only to specific product lines or business units, the boundaries of compliance activities become vague and accountability becomes unclear. §3.1.4 requires a documented written statement that clearly defines which software, organizational units, and distribution channels the open source program applies to, and what is outside the scope. The scope may vary depending on the organization&rsquo;s size and business model, and this clause requires that choice to be explicitly recorded.</p>https://korea-wg.openchainproject.org/en/guide/iso18974_guide/1-program-foundation/4-scope/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/iso18974_guide/1-program-foundation/4-scope/<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">★ 18974 Exclusive Items — Documented Evidence Strength</div> <p>§4.1.4.2·§4.1.4.3 are ISO 18974 exclusive (★) items requiring <strong>Documented Evidence</strong>. Metrics must include actual measurement data; continuous improvement must retain review/audit meeting minutes. For a detailed explanation of the strength difference, see <a href="https://korea-wg.openchainproject.org/en/guide/iso18974_guide/1-program-foundation/5-standard-practice/#evidence-strength-for-iso-18974-exclusive--items--documented-evidence">§4.1.5 Standard Practices — Documented Evidence Notice</a>.</p> </div> <h2 id="1-clause-overview">1. Clause Overview</h2> <p>§4.1.4 is the clause from ISO/IEC 5230 §3.1.4 (Program Scope) with 2 additional Verification Materials. While 5230 only requires a written statement that clearly defines the program&rsquo;s scope, 18974 additionally requires a <strong>set of performance metrics the program seeks to improve upon (4.1.4.2)</strong> and <strong>documented evidence from each review, update, or audit demonstrating continuous improvement (4.1.4.3)</strong>. These two items are intended to demonstrate that the security assurance program is not static compliance, but a system with measurable goals that continuously improves.</p>