ISO/IEC 5230

OpenChain ISO/IEC 5230:2020 is an international standard on the key requirements for a high-quality open source license compliance program. The standard was published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in late 2020. The standard is based on the Linux Foundation OpenChain Specification 2.1. It focuses on software supply chains, easier procurement and license compliance. Organizations that meet the requirements of the standard can self-certify to ISO/IEC 17021, from an accredited certification body or after successfully completing an audit.[1][2][3][4]

How the standard works

Most organizations and software products rely on numerous open source components made by third parties, such as frameworks, libraries and containers, coming from diverse and often unaffiliated sources. This is akin to a supply chain in a brick-and-mortar environment and making sure the supply chain is as reliable as possible is considered important from an operational, legal and security standpoint. Upon this premise, a number of players have decided to establish the ground rules for an organization to deal with open source software at whichever level of the supply chain they operate. A working group under the umbrella of the Linux Foundation, the OpenChain project. Later, when reaching the 2.0 version, the norms were presented for approval as an ISO/IEC standard.

According to the standard, in order to use open source components effectively, organization must be aware of and comply with all the components involved, the associated open source licenses, and obligations such as copyleft. ISO/IEC 5230 aims to establish a non-prescriptive common understanding of what needs to be addressed within a quality open source compliance program. This makes ISO/IEC 5230 applicable across many industries and organizations and provides benefits to procurement and software supply chains, as open source software tends to be very cumbersome in legal contracts and procurement.

The main topics covered by ISO/IEC 5230 and OpenChain-2.1 are:

  • Existence of an open source policy
  • Competencies of program participants (e.g., legal training for specific tasks).
  • Awareness of open source risks among all program participants
  • A clearly defined scope, e.g. only specified areas and product lines
  • Understand and collect licensing obligations for relevant use cases.
  • Access for external open source requests (e.g. to the OSS authors).
  • Compliance offices equipped with sufficient resources
  • Generate a Bill of Material
  • License compliance process (e.g., documents meeting obligations)
  • Archiving and provision of compliance artifacts
  • A guideline for community engagement and contributions

ISO/IEC 5230 does not define how exactly most of the tasks are to be performed, such as whether snippet scanning, revalidation of declared open source licenses is required, and what the compliance artifacts should look like. However, SPDX is now an ISO standard (ISO/IEC 5962) and is mentioned in ISO/IEC 5230 as an example of compliance artifacts.

Certification

The OpenChain ISO/IEC 5230 Specification identifies the key requirements of a quality open source compliance program. OpenChain Conformance allows organizations to show they meet these requirements. Certification of compliance with ISO/IEC 5230 can be reached in three ways providing a path for organizations of all sizes and program maturity.

Self-certification

The OpenChain community provides a free online self-assessment checklist that organizations can use to assess their compliance with the OpenChain Specification. The questionnaire covers various aspects of an organization's software supply chain management practices, including policies, procedures, and documentation related to open source compliance.

Using the OpenChain self-assessment questionnaire, an organization can evaluate the effectiveness and completeness of its open source compliance program, identify areas for improvement, and take corrective actions. The questionnaire can also be used as a tool for internal health checks to regularly assess and maintain the organization's compliance program.

Once an organization completes the self-assessment questionnaire, it can choose to inform the OpenChain Project and be listed in the OpenChain Project website. However, the progress and results of the assessment are private until the organization decides to submit them for publication. This allows organizations to conduct a thorough self-assessment of their open source compliance program without publicizing any potential issues or gaps in their compliance efforts.

Independent assessment

An independent assessment of a high-quality open source compliance program may be performed for additional assurance, accountability, separation of duty, and alignment with enterprise risk management.

An independent assessment is typically conducted by individuals within the organization or company but independent from the open source program under evaluation, or by individuals from an external organization or company. Components of an independent assessment may include the following:

  1. Self-Assessment Questionnaire: The self-assessment questionnaire is a set of questions that helps an organization assess its compliance with the OpenChain Specification. The questionnaire covers various aspects of the organization's software supply chain management processes and practices.
  2. Documentation Review: The assessor will review the documentation that the organization has prepared to support its self-certification. This includes policies, procedures, guidelines, and other documentation related to the organization's software supply chain management practices.
  3. Interview: The assessor will conduct interviews with key personnel within the organization to gain a better understanding of the organization's software supply chain management practices. This helps the assessor to identify any gaps or weaknesses in the organization's compliance with the OpenChain Specification.
  4. Assessment Report: The assessor will prepare a report that documents the findings of the assessment. The report will identify any non-compliances with the OpenChain Specification and provide recommendations for addressing these non-compliances.
  5. Certification: If the organization has successfully demonstrated compliance with the OpenChain Specification, the assessor will issue a certificate of compliance. The certificate indicates that the organization has met the requirements of the OpenChain Specification and is authorized to use the OpenChain Conformance Mark.

Third-party certification

Third-Party Certification for OpenChain ISO/IEC 5230 can be carried out by an OpenChain Third-Party Certifier listed on the OpenChain Partners website. Optionally, third parties may be accredited certifiers by numerous registrars worldwide. These organizations may be referred to as certification bodies, registration bodies, assessment and registration bodies, certification/registration bodies, or registrars, depending on the country.

The certification process involves an external audit of an organization's open source compliance program against the requirements set out in ISO/IEC 5230. The initial certification is carried out in two stages, as defined in ISO/IEC 17021. The first stage is a review of the documentation of the open source compliance program, which evaluates the existence, design, and completeness of key documents such as the organization's open source policy, clearing process, and staffing. The second stage is an audit, where the open source compliance program is independently audited for evidence that it has been properly implemented, and is in operation. Passing this phase results in receiving a certificate from the external certification body which can be shared with interested parties and displayed on the company's websites.

After certification, the organization is required to maintain compliance with the standard set forth by applicable registration bodies, by undergoing periodic surveillance audits and recertification audits to confirm that the quality open source compliance program continues to function as specified and intended. These follow-up reviews or audits help the organization to identify areas for improvement and ensure that they continue to meet the requirements of the standard.

Overall, certification of compliance with ISO/IEC 5230 provides independent verification that an organization has implemented a high-quality open source compliance program and is committed to ongoing compliance with the standard. The certification process helps organizations to identify gaps in their compliance program and take corrective actions to improve their open source compliance practices.

Dissemination

On October 19, 2020, the Eclipse Foundation announced that it is the first open source foundation to be certified to ISO/IEC 5230.[5] Several companies, including SAP, Toshiba, Samsung Electronics and LG Electronics have publicly announced their conformance to OpenChain.

Source

First version of this article was translated from the article on German Wikipedia.

References
  1. Coughlan, Shane (2022). "Transforming the Supply Chain with Openchain Iso 5230". Open Source Law, Policy and Practice. pp. 141–C6.P28. doi:10.1093/oso/9780198862345.003.0006. ISBN 978-0-19-886234-5.
  2. McClurg, John (May 2022). "A New Level of Trust: Corporate-Wide OpenChain ISO/IEC 5230:2020 Conformance". Security. Vol. 59, no. 5. Troy. p. 25. ProQuest 2666597005.
  3. "Toyota Is The First Company To Announce Adoption Of ISO/IEC 5230, The International Standard For Open Source Compliance" (Press release). 15 December 2020. ProQuest 2470636334.
  4. "Liferay Announces OpenChain Conformance". Investment Weekly News. 16 November 2019. p. 354. ProQuest A605360074.
  5. Möbus, Maika (2021-10-20). "Open Source: Eclipse Foundation erreicht OpenChain-Konformität". Heise online. Retrieved 2022-11-24.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.