https://korea-wg.openchainproject.org/en/tags/resources/Recent content in Resources on OpenChain KWGHugoenhttps://korea-wg.openchainproject.org/en/guide/iso5230_guide/2-relevant-tasks/2-resourced/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/iso5230_guide/2-relevant-tasks/2-resourced/<h2 id="1-clause-overview">1. Clause Overview</h2> <p>For an open source program to actually function, it is not enough to just define roles. Actual personnel must be assigned to each role, and sufficient time and budget must be provided to carry out the work. §3.2.2 requires organizations to document the persons responsible for each program role, confirm that staffing and budget are appropriately allocated, and to have a method for accessing legal expertise, a procedure for assigning internal responsibilities, and a procedure for handling non-compliance cases. This clause consists of five verification material items and is the stage that implements the role structure defined in §3.1 Program Foundation into an actual operational framework.</p>https://korea-wg.openchainproject.org/en/guide/iso18974_guide/2-relevant-tasks/2-resourced/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/iso18974_guide/2-relevant-tasks/2-resourced/<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">★ 18974 Exclusive Items — Documented Evidence Strength</div> <p>§4.2.2.3 is an ISO 18974 exclusive (★) item requiring <strong>Documented Evidence</strong>. The method for accessing vulnerability resolution resources is not merely a procedure document — you must retain actual resource utilization records (security advisory contracts, account issuance records, access logs). For a detailed explanation of the strength difference, see <a href="https://korea-wg.openchainproject.org/en/guide/iso18974_guide/1-program-foundation/5-standard-practice/#evidence-strength-for-iso-18974-exclusive--items--documented-evidence">§4.1.5 Standard Practices — Documented Evidence Notice</a>.</p> </div> <h2 id="1-clause-overview">1. Clause Overview</h2> <p>§4.2.2 corresponds to ISO/IEC 5230 §3.2.2 (Effectively Resourced) but has two key differences. First, while 5230 requires 5 Verification Materials, 18974 requires 4. The §3.2.2.5 item from 5230 (procedure for reviewing and correcting non-compliance cases) is absorbed into §4.1.5 Standard Practice Implementation in 18974. Second, §3.2.2.3 (method for accessing legal expertise) is replaced in §4.2.2.3 by <strong>vulnerability resolution expertise</strong>. Rather than legal expertise for license matters, the organization must secure technical and security expertise capable of actually resolving known vulnerabilities and document how that expertise is accessed.</p>