Shane Coughlan

The OpenChain Project is ready to start accepting feedback to improve our license compliance and security standards.

OpenChain Security Assurance Specification:
https://github.com/OpenChain-Project/Security-Assurance-Specification

Easy way to suggest Security Assurance Specification improvements:
https://github.com/OpenChain-Project/Security-Assurance-Specification/issues/new/choose

OpenChain License Compliance Specification (ISO/IEC 5230):
https://github.com/OpenChain-Project/License-Compliance-Specification

Easy way to suggest License Compliance Specification improvements:
https://github.com/OpenChain-Project/License-Compliance-Specification/issues/new/choose

You can also send your suggestions to our specification mailing list:
https://lists.openchainproject.org/g/specification

Notes

• The next generation of our license compliance standard will update ISO/IEC 5230.
• Our security assurance standard (generation 1) is scheduled to become an ISO/IEC standard in mid-2023. The update to generation 2 will trigger an update to the new ISO/IEC standard for late 2023~mid-2024.
• You will find extensive feedback on our standards already exists on GitHub and you can easily review that before submitting a suggestion for improvement.

Pre-existing submissions for the security assurance standard:

https://github.com/OpenChain-Project/Security-Assurance-Specification/issues

Pre-existing submissions for the license compliance standard:

https://github.com/OpenChain-Project/License-Compliance-Specification/issues

The OpenChain Security Assurance Specification 1.1 self-certification checklist is now available in Simplified Chinese. A big thank you to Zhang Jun Xia from CAICT for making this happen.

This checklist is designed to help organizations adopt the de facto standard for open source security assurance. Organizations using this self-certification process will also meet the requirements of the specification when it graduates the ISO/IEC JTC-1 PAS Transposition process, with an estimated arrival time of that International Standard in mid-2023.

The checklist contains a series of “yes” or “no” statements. If you can answer “yes” to everything, you are self-certified. If you answer “no” to some items, you know where to invest further time to build a quality security assurance program.

---

Do you want to get the English version of the self-certification checklist?

---

This checklist is licensed under CC-0 (effectively public domain), so you can take it, integrate it, and remix it without any restrictions. You do not even have to provide attribution.

We welcome contributions to improve this checklist. You can contribute by opening a GitHub issue here:
https://github.com/OpenChain-Project/Reference-Material/issues

The OpenChain Security Assurance Specification 1.1 self-certification checklist is now available. This is designed to help organizations adopt the de facto standard for open source security assurance. Organizations using this self-certification process will also meet the requirements of the specification when it graduates the ISO/IEC JTC-1 PAS Transposition process, with an estimated arrival time of that International Standard in mid-2023.

The checklist contains a series of “yes” or “no” statements. If you can answer “yes” to everything, you are self-certified. If you answer “no” to some items, you know where to invest further time to build a quality program.

---

This checklist is licensed under CC-0 (effectively public domain), so you can take it, integrate it, and remix it without any restrictions. You do not even have to provide attribution.

We welcome contributions to improve this checklist. You can contribute by opening a GitHub issue here:
https://github.com/OpenChain-Project/Reference-Material/issues

The OpenChain Project has been very active since its formal launch in late 2016. Our global community has built an ISO/IEC standard for license compliance, launched a de facto (and soon to be ISO/IEC) standard for security. We have contributed to SBOM, OSPO, training, policy and other discussions. We built the world’s largest library of open source management reference material.

To reflect our growth and to make it easier to navigate the project we are going to make some adjustments to our work groups. Nothing too radical, but definitely something to help people find their way around more quickly, and to get the information they want faster. The image above contains a summary of the evolution approved by our Governing Board at their last meeting in September, and targeted for release during October 2022.

The changes?

1. The Specification Work Group will split into two parts – a Licensing Work Group for ISO/IEC 5230 and a Security Work Group for the Security Assurance Specification.
2. The Education Work Group and Outreach Work Group will combine into the Education Work Group.
3. We will launch a new Export Control Work Group and a new Policy Work Group. The former will help to navigate issues around increasing international trade tensions. The later will help us provide strategic advice around the highest level of planning for open source in legislation and business.
4. The dormant Conformance Work Group will be wound down and discussions regarding self-certification moved to Education Work Group, with discussions about the nuance of conformance parameters moved to our Steering Committee.
5. Finally (if there are no objections), we will re-brand the Reference Tooling Work Group to the Automation Work Group to help guide people hearing about automation to the right solutions.

Feedback?

Your feedback – as always – is most welcome. Please provide comments to our main mailing list:
https://lists.openchainproject.org/g/main

Please provide feedback by Close of Business UTC (17:00 UTC) on the 18th of October 2022.