Shane Coughlan

The OpenChain Security Assurance Specification 1.1 has been building momentum as a sister specification to ISO/IEC 5230:2020, the International Standard for open source license compliance. With an identical approach to high level process management, the OpenChain Security Assurance Specification is designed to help companies adopt the key requirements of a quality open source security assurance program.

Self-certification is available in English, German and Simplified Chinese. In addition, the following companies have announced services to support adoption of this specification. Three of these organizations are OpenChain Project official third-party certifiers, and all of these companies provide onboarding, adoption and review services across the global supply chain.

CAICT (Mainland China)

CAICT is an official OpenChain Project partner and one of our third-party certifiers with a regional service offering.

• CAICT OpenChain Security Assurance Specification services in Simplified Chinese:
  https://mp.weixin.qq.com/s/IdmxXc6uwV9ll1Xqo2KyZw

Bureau Veritas (Taiwan, Worldwide)

Bureau Veritas is an official OpenChain Project partner and one of our third-party certifiers with a global service offering.

• Bureau Veritas OpenChain Security Assurance Specification services in English:
  https://ee.bureauveritas.com.tw/BVInternet/Product/46;mainIDX=20?lang=en
• Bureau Veritas OpenChain Security Assurance Specification services in Traditional Chinese:
  https://ee.bureauveritas.com.tw/BVInternet/Product/46;mainIDX=20?lang=tw

PwC (Germany, Worldwide)

PwC is an official OpenChain Project partner and one of our solution providers and third-party certifiers with a global service offering.

• PwC OpenChain Security Assurance Specification services in English:
  https://www.pwc.de/en/opensource
  (Under ‘Consulting & Implementation’ and ‘Audit & Certification’)

Orcro (UK, Worldwide)

Orcro is an official OpenChain Project partner and one of our solution providers and third-party certifiers with a global service offering.

• Orcro OpenChain Security Assurance Specification services in English:
  https://orcro.co.uk/services/openchain-security-assurance/

Source Code Control (UK, Worldwide)

Source Code Control is an official OpenChain Project partner and one of our solution providers with a global service offering.

• Source Code Control OpenChain Security Assurance Specification services in English:
  https://sourcecodecontrol.co/security-assurance/

OSS Consultants (USA, Worldwide)

OSS Consultants is an official OpenChain Project partner and one of our solution providers with a global service offering.

• OSS Consultants OpenChain Security Assurance Specification services in English:
  https://ossconsultants.com/open-chain-conformance/

The OpenChain Security Assurance Specification 1.1 is now available in Simplified Chinese. This translation was created by Zhang Jun Xia from the China Academy of Information and Communications Technology (翻译人：张俊霞，中国信息通信研究院). Zhang Jun Xia previously contributed the Simplified Chinese self-certification checklist for this specification.

The GitHub version is stored as MarkDown, a type of text format. Do you want to download it in different formats?

Please note that we are always glad to have review for any errors in the translations we provide, and we are always glad to receive new translations. We work via GitHub and you can find the OpenChain Security Assurance Specification repository here:

• https://github.com/OpenChain-Project/Security-Assurance-Specification

The OpenChain Project has invested resources throughout 2022 towards improving the sustainability and continuity of our project. As part of this, the OpenChain Project Governing Board decided to initiate a chairperson election. This initiative was lead by David Marr of Qualcomm, our founding chairperson, and was designed to introduce processes for a predictable cycle of leadership rotation at the very top of the project management structure.

Jimmy Ahlberg of Ericsson was duly elected OpenChain Project Governing Board Chair on the 8th of December by his peers, the voting members of the OpenChain Project Governing Board. The board is made up of one voting representative from each of the Platinum Member companies. We currently have 24 Platinum Members spread across three continents, providing one of the most geographically diverse boards in our industry.

The OpenChain Board Chair is a pivotal position. As with everything in this project, it is a position that offers influence but not control, though in this case the influence is specifically targeted towards our long-term strategic future. Jimmy has been elected for a period of three years.

As the steward of two industry standards, one of which already has an ISO/IEC grant, the OpenChain Project Governing Board has a responsibility to ensure stability and sustainability. From fiscal decisions to overarching strategy, they meet once a quarter to assess our status and future steps. Because this is an open source project, their decisions are not taken in isolation. Our community has tremendous latitude and influence on this project, and our board has tremendous respect for what that means.

Jimmy is stepping into the role with the continued support of David and the rest of the OpenChain Project Governing Board, and our fundamental strategy remains consistent. This said, we expect and look forward to Jimmy making his mark as new chairperson, and innovating around our top-level strategy based on his insight, experience and corporate background. 

If you have questions, comments or suggestions directed towards Jimmy, don’t hesitate to connect with him on one of our monthly calls, via our mailing lists or by direct mail. The leadership of the OpenChain Project is here to serve you, the community seeking to build trust in the supply chain. 

To end this lengthy post, please note that the OpenChain Project Governing Board formally thanks David Marr for his exceptional work in founding and growing this project. He first brought people together to discuss the concept of standardization around open source license compliance eight years ago, and it takes a special type of determination and community-building to turn that into an executed ISO/IEC standard. It is also thanks to David that we have expanded our activities based on community feedback to other aspects of a trusted supply chain. His impact has been and continues to be immeasurable.

The OpenChain Security Assurance Specification 1.1 is now available in German. Self-certification is also available via checklists and questionnaires. Huge thanks to Katharina and the rest of the the team at PwC for making this happen.

Get the OpenChain Security Assurance Specification 1.1 in German:

Self-Certify to the OpenChain Security Assurance Specification 1.1 in German via a checklist:

Self-Certify to the OpenChain Security Assurance Specification 1.1 in German via a questionnaire:

If you self-certify, you can be listed on the OpenChain Project website alongside your peers. This is optional but recommended as a useful exercise for the supply chain. Contact us to get the free process underway.

Self-certification for the Security Assurance Specification 1.1 is now available in English, Simplified Chinese and German. More languages are expected to be made available soon.

Helio Chissini de Castro, CARIAD

Chris Wood, Lockheed Martin

The OpenChain Project recently held an election for Specification Work Group co-chair. The suggested nominees from the community vote were passed to the OpenChain Governing Board for review and – on the 8th of December – were unanimously accepted by the OpenChain Platinum Members.

Helio Chissini de Castro, CARIAD and Chris Wood, Lockheed Martin are duly announced as the co-chairs of the OpenChain Specification Work Group for a period of one year. Congratulations both!

Join our specification mailing list to keep up to date with our work around ISO/IEC 5230 and the OpenChain Security Assurance Specification:

• https://lists.openchainproject.org/g/specification