Having an OpenChain conformant program for ISO/IEC 5230 or ISO/IEC 18974 (or both) means that an organization has a program that uses our process standards for addressing open source license compliance or security assurance.

You need to check with the organization about how their program is scoped (does it cover one project, one product or the whole legal entity?) and you need to ensure – if you are doing business with that organization – that what they consider solid process management matches your own requirements.

The good news is that any OpenChain conformant organization should be providing external contact points for open source license compliance or security assurance matters. It is part of the requirements listed in the standards themselves.