Shane Coughlan is an expert in communication, security and business development. His professional accomplishments include spearheading the licensing team that elevated Open Invention Network into the largest patent non-aggression community in history, establishing the leading professional network of Open Source legal experts and aligning stakeholders to launch both the first law journal and the first law book dedicated to Open Source. Shane has extensive knowledge of Open Source governance, internal process development, supply chain management and community building. His experience includes engagement with the enterprise, embedded, mobile and automotive industries.
China Industrial Control System Cyber Emergency Response Team (CIC), an official OpenChain Partner, has added third-party certification to the portfolio of services they offer in the OpenChain ecosystem. With this development, the OpenChain Project is proud to note a total of 14 official third-party certifiers in the official partner program.
The OpenChain Project started when David Marr brought people together to talk about improved trust in the supply chain in 2015. The outcome of this action – and his work to lead it as chair from 2016 to 2021 – is dramatically increased trust in the supply chain. As an official outcome of its Q4 2023 Governing Board Meeting, the OpenChain Governing Board hereby thanks David Marr by naming him Chair Emeritus of the OpenChain Project. This is an honorary position that can permanently signal his contribution.
Newsletter – Issue 61 – December 2023
The OpenChain Newsletter provides a monthly summary of our work. It contains an overview of what we are doing to build trust around license compliance and security in the open source supply chain. We accept suggestions and ideas. Feel free to mail us at any time.
OpenChain Welcomes ISO/IEC 18974:2023
The International Standard For Open Source Security Assurance
Our community held the following meetings:
On December 18, NEDO Silicon Valley hosted a webinar titled “Maximizing Benefits, Minimizing Risks: An IP approach to Open Source.” This event was a part of the Bay Area CHIZAI (IP) Seminar Series.
The OpenChain Project was represented by Shane Coughlan, OpenChain General Manager.
Keep track of all our monthly calls working on the OpenChain standards via our specification mailing list:
This is the first planning call for an OpenChain Study Group focused around the topic of AI compliance. The goal is to formally start the AI Study Group in 2024.
After this call, a mailing list was created for the AI Study Group, and this is where future activities will be coordinated. Everyone is invited to participate.
KakaoBank is the first company to formally announce conformance to ISO/IEC 18974:2023 adjacent to the ISO publication of the specification.
Learn more about the KakaoBank announcement: https://www.openchainproject.org/news/2023/11/22/kakaobank-iso18974
The Linux Foundation, Joint Development Foundation and the OpenChain Project are delighted to announce the publication of ISO/IEC 18974:2023 as an International Standard. Formally known as OpenChain Security Assurance 1.1 or ISO/IEC DIS 18974, this is a simple, clear and effective process management standard for open source security assurance. It allows companies of all sizes and in all sectors to adopt the key requirements of a quality open source security assurance program.
Companies around the world can learn more about ISO/IEC 18974:2023, methods of self-certification, independent assessment or third-party certification, as well as access a large library of reference material at https://www.openchainproject.org
ISO/IEC 18974:2023 is an open standard and all parties are welcome to engage with our community, learn from their peers, share their knowledge, and to contribute to the future of our standard. There is no charge to access and use our reference material, self-certification or to engage with our numerous calls, webinars, mailing lists and meetings.
“ISO/IEC 18974:2023 is the result of over seven years work in building simple, effective process management specifications for the open source supply chain. As a sister standard to ISO/IEC 5230:2020, the International Standard for open source license compliance, it has a direct pedigree based on decades of open source management experience distilled and applied by hundreds of contributors. It can immediately be used by companies of any sizes to reduce risk, increase efficiency and ensure sustainability around code management.”
Shane Coughlan, OpenChain General Manager
This standard was created with the input of dozens of people across a period of more than a year. The majority of this process was lead by the co-chairs of the OpenChain Specification Work Group, Chris Wood, Fellow at Lockheed Martin and Helio Chissini de Castro, Software Technologies Lead at CARIAD – a Volkswagen Group Company.
“It is a great accomplishment for the OpenChain team’s hard work to have our Software Assurance specification accepted for publication as an Internationally recognized specification by ISO/IEC.”
Chris Wood, Fellow at Lockheed Martin
“ISO/IEC 18974 fills a market gap that OpenChain could effectively address by connecting people. In a world where security and compliance are no longer seen side by side but rather crossing paths, an intelligent approach on how to manage this situation was needed by professionals. OpenChain provided the right people and the right environment to achieve a practical solution based on the approach previously proven via ISO/IEC 5230.”
Helio Chissini de Castro, Software Technologies Lead at CARIAD – a Volkswagen Group Company.
Industry reception has been equally positive, with the follow endorsement from OPPO – an OpenChain Platinum Member – underlining the global applicability of ISO/IEC 18984:2023 for open source security assurance.
“As a core member of OpenChain, OPPO is pleased to see OpenChain’s newly released ISO standard, which aims to ensure the security of the open source software’s supply chain. The development is expected to bring numerous strengths to OPPO and its partners, including enhanced security, improved product quality, and increased competitive advantages. This achievement marks yet another significant milestone in the ongoing development of OpenChain.”
Haydon, Vice President of OPPO and President of Software Engineering
Our official partners at PwC Germany have added their endorsement from the perspective of open source management, regulatory bodies and third-party certification.
“Great joint effort and achievement! As regulatory bodies increasingly recognize the significance of cybersecurity and the necessity for Software Bill of Materials (SBOMs), the introduction of ISO 18974 is a timely and important element for open source management. Its adoption will enhance the resilience and reliability of digital products and services. Furthermore, an external ISO 18974 certification will boost trust within the supply chain and facilitate efficient collaboration.”
Marcel Scholze, Head of Open Source Management Services at PwC Germany
Other companies have previously adopted ISO/IEC 18974:2023 in its OpenChain Security Assurance 1.1 or ISO/IEC DIS 18974:2023 variants, including LG Electronics and BlackBerry. These are functionally identical to ISO/IEC 18974:2023. You can learn more about the companies adopting OpenChain Project standards by visiting our “Community of Conformance” page:
https://www.openchainproject.org/community-of-conformance
Keep track of all the activities of the Education Work Group via their dedicated mailing list:
On 2023-12-14 the OpenChain Project held a special strategic workshop in Beijing on Licensing, Security and Export Control Compliance matters. You can check out the full recording below.
China Industrial Control Systems Cyber Emergency Response Team (CIC) is the latest official OpenChain Partner. They will help companies in China with process development and compliance scanning activities.
“China Industrial Control Systems Cyber Emergency Response Team ( CIC ) is delighted to become an official partner of the OpenChain Project,” said Huang Yunhua, deputy director of the CIC’s Institute of Intellectual Property. “OpenChain ISO/IEC 5230 stipulates key requirements for a high-quality open source license compliance program, which can effectively improve the level of open source supply chain security governance services. We will actively promote the application of OpenChain standards in the field of industrial and information safety, provide services for the domestic open source ecology and related enterprises, and build a more reliable open source software supply chain.”
“The OpenChain Project welcomes CIC to the official partner community today,” says Shane Coughlan, OpenChain General Manager. “This is an important development in strengthening the provision of ISO 5230 and ISO 18974 services in the Chinese market, and it is also an important development in terms of building event more bridges between China and other parts of the global supply chain. As a leader in the open source market, China and Chinese companies are critical to good governance in what we do. Our next steps together will help make open source more effective and more valuable for everyone involved.”
© 2025 OpenChain. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page. Linux is a registered trademark of Linus Torvalds. Privacy Policy and Terms of Use
