ISO Standard-Based Enterprise Open Source Management Guide
This guide introduces ways for enterprises to effectively manage open source based on ISO international standards.
If an organisation fails to manage open source, it may encounter risks such as license non-compliance and security breaches. Therefore, what and how should we manage it?
In this article, we will examine the minimum core requirements and techniques that organisations need to implement for managing open source based on ISO international standards.
Author: Haksung Jang (haksung@sktelecom.com)
International Standards for Open Source Management
There are two global standards for open source management:
- ISO/IEC 5230: OpenChain Specification - International standard for open source compliance.
- ISO/IEC 18974: OpenChain Security Assurance Specification - International standard for Open Source Security
OpenChain Project
The international standard for managing these open sources was created by the OpenChain Project. For an introduction to this, please refer to the following page: OpenChain Project
What should companies do?
If a company complies with the requirements of the two standards (ISO/IEC 5230, ISO/IEC 18974), it can be seen as effectively managing open source.
So, what should companies do to comply with the standards? It needs to have the following six components:
- Organization
- Policy
- Process
- Tools
- Education
- Conformance
To comply with the standards, companies must adhere to these six components: