ISO/IEC 5230

Last updated

ISO/IEC 5230 (known as OpenChain) is an international standard on the key requirements for a high-quality open source license compliance program. The standard was published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in late 2020. The standard is based on the Linux Foundation OpenChain Specification 2.1. It focuses on software supply chains, easier procurement and license compliance. Organizations that meet the requirements of the standard can self-certify to ISO/IEC 17021, from an accredited certification body or after successfully completing an audit. [1] [2] [3] [4]

Contents

How the standard works

Most organizations and software products rely on numerous open source components made by third parties, such as frameworks, libraries and containers, coming from diverse and often unaffiliated sources. This is akin to a supply chain in a brick-and-mortar environment and making sure the supply chain is as reliable as possible is considered important from an operational, legal and security standpoint. Upon this premise, a number of players have decided to establish the ground rules for an organization to deal with open source software at whichever level of the supply chain they operate. A working group under the umbrella of the Linux Foundation, the OpenChain project. Later, when reaching the 2.0 version, the norms were presented for approval as an ISO/IEC standard.

According to the standard, in order to use open source components effectively, organization must be aware of and comply with all the components involved, the associated open source licenses, and obligations such as copyleft. ISO/IEC 5230 aims to establish a non-prescriptive common understanding of what needs to be addressed within a quality open source compliance program. This makes ISO/IEC 5230 applicable across many industries and organizations and provides benefits to procurement and software supply chains, as open source software tends to be very cumbersome in legal contracts and procurement.

The main topics covered by ISO/IEC 5230 and OpenChain-2.1 are:

ISO/IEC 5230 does not define how exactly most of the tasks are to be performed, such as whether snippet scanning, revalidation of declared open source licenses is required, and what the compliance artifacts should look like. However, SPDX is now an ISO standard (ISO/IEC 5962) and is mentioned in ISO/IEC 5230 as an example of compliance artifacts.

Certification

A high-quality open source compliance program can be certified as compliant with ISO/IEC 5230 by a number of accredited registrars worldwide.

In some countries, the bodies that verify the conformity of management systems to certain standards are referred to as "certification bodies", while in others they are usually referred to as "registration bodies", "assessment and registration bodies", "certification/registration bodies" and sometimes "registrars".

ISO/IEC 5230 certification, like other ISO management system certifications, typically involves a three-step external audit process defined in ISO/IEC 17021:

Continuous means that follow-up reviews or audits are conducted to confirm that the organization continues to be compliant with the standard. Maintenance of certification requires periodic re-audits to confirm that the quality open source compliance program continues to function as specified and intended. These should occur at least annually, but are often conducted more frequently (in consultation with management), especially while the Quality Open Source Compliance Program is still under development. Additionally, ISO/IEC 5230 is functionally identical to OpenChain 2.1, which enables free self-certification via the project's web app.

Dissemination

On October 19, 2020, the Eclipse Foundation announced that it is the first open source foundation to be certified to ISO/IEC 5230. [5] Several companies, including SAP, Toshiba, Samsung Electronics and LG Electronics have publicly announced their conformance to OpenChain.

Source

First version of this article was translated from the article on German Wikipedia.

Related Research Articles

The Single UNIX Specification (SUS) is a standard for computer operating systems, compliance with which is required to qualify for using the "UNIX" trademark. The standard specifies programming interfaces for the C language, a command-line shell, and user commands. The core specifications of the SUS known as Base Specifications are developed and maintained by the Austin Group, which is a joint working group of IEEE, ISO/IEC JTC 1/SC 22/WG 15 and The Open Group. If an operating system is submitted to The Open Group for certification, and passes conformance tests, then it is deemed to be compliant with a UNIX standard such as UNIX 98 or UNIX 03.

Conformance testing — an element of conformity assessment, and also known as compliance testing, or type testing — is testing or other activities that determine whether a process, product, or service complies with the requirements of a specification, technical standard, contract, or regulation. Testing is often either logical testing or physical testing. The test procedures may involve other criteria from mathematical testing or chemical testing. Beyond simple conformance, other requirements for efficiency, interoperability, or compliance may apply. Conformance testing may be undertaken by the producer of the product or service being assessed, by a user, or by an accredited independent organization, which can sometimes be the author of the standard being used. When testing is accompanied by certification, the products or services may then be advertised as being certified in compliance with the referred technical standard. Manufacturers and suppliers of products and services rely on such certification including listing on the certification body's website, to assure quality to the end user and that competing suppliers are on the same level.

The Common Criteria for Information Technology Security Evaluation is an international standard for computer security certification. It is currently in version 3.1 revision 5.

The ISO 9000 family is a set of five quality management systems (QMS) standards by the International Organization for Standardization (ISO) that help organizations ensure they meet customer and other stakeholder needs within statutory and regulatory requirements related to a product or service. ISO 9000 deals with the fundamentals and vocabulary of QMS, including the seven quality management principles that underlie the family of standards. ISO 9001 deals with the requirements that organizations wishing to meet the standard must fulfill. ISO/TS 9002 offers guidelines for the application of ISO 9001. ISO 9004 gives guidance on achieving sustained organizational success.

Software quality assurance (SQA) is a means and practice of monitoring all software engineering processes, methods, and work products to ensure compliance against defined standards. It may include ensuring conformance to standards or models, such as ISO/IEC 9126, SPICE or CMMI.

Accreditation is the independent, third-party evaluation of a conformity assessment body against recognised standards, conveying formal demonstration of its impartiality and competence to carry out specific conformity assessment tasks.

ISO/IEC 20000 is the international standard for IT service management. It was developed in 2005 by ISO/IEC JTC1/SC7 and revised in 2011 and 2018. It was originally based on the earlier BS 15000 that was developed by BSI Group.

<span class="mw-page-title-main">Product certification</span> Performance and quality assurance

Product certification or product qualification is the process of certifying that a certain product has passed performance tests and quality assurance tests, and meets qualification criteria stipulated in contracts, regulations, or specifications.

IEC 61508 is an international standard published by the International Electrotechnical Commission (IEC) consisting of methods on how to apply, design, deploy and maintain automatic protection systems called safety-related systems. It is titled Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems.

Software asset management (SAM) is a business practice that involves managing and optimizing the purchase, deployment, maintenance, utilization, and disposal of software applications within an organization. According to ITIL, SAM is defined as “…all of the infrastructure and processes necessary for the effective management, control, and protection of the software assets…throughout all stages of their lifecycle.” Fundamentally intended to be part of an organization's information technology business strategy, the goals of SAM are to reduce information technology (IT) costs and limit business and legal risk related to the ownership and use of software, while maximizing IT responsiveness and end-user productivity. SAM is particularly important for large corporations regarding redistribution of licenses and managing legal risks associated with software ownership and expiration. SAM technologies track license expiration, thus allowing the company to function ethically and within software compliance regulations. This can be important for both eliminating legal costs associated with license agreement violations and as part of a company's reputation management strategy. Both are important forms of risk management and are critical for large corporations' long-term business strategies.

An environmental audit is a type of evaluation intended to identify environmental compliance and management system implementation gaps, along with related corrective actions. In this way they perform an analogous (similar) function to financial audits. There are generally two different types of environmental audits: compliance audits and management systems audits. Compliance audits tend to be the primary type in the US or within US-based multinationals.

ISO/IEC 27006 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Part of the ISO/IEC 27000 series of ISO/IEC Information Security Management System (ISMS) standards, it is titled Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems.

The ISO/IEC 27001 Lead Auditor certification consists of a professional certification for auditors specializing in information security management systems (ISMS) based on the ISO/IEC 27001 standard and ISO 19011.

ISO/IEC 27001 Lead Implementer is a professional certification for professionals specializing in information security management systems (ISMS) based on the ISO/IEC 27001 standard. This professional certification is intended for information security professionals wanting to understand the steps required to implement the ISO/IEC 27001 standard.

<span class="mw-page-title-main">British Approvals Service for Cables</span>

British Approvals Service for Cables is an independent accredited certification body headquartered in Milton Keynes, United Kingdom. Here, the organization's dedicated testing laboratory also operates which is believed to be the largest of its type in Europe. BASEC was established in 1971 and principally provides product certification services for all types of cable and wire, ancillary products and management systems within the cable industry. The organization maintains operations throughout the world including Africa, Middle East, America, Asia and Europe.

The Global Food Safety Initiative (GFSI) is a private organization that works as a "coalition of action" from the Consumer Goods Forum (CGF) and brings together retailers and brand owners (manufacturers) from across the CGF membership. The GFSI operates under multi-stakeholder governance, with the objective to create "an extended food safety community to oversee food safety standards for businesses and help provide access to safe food for people everywhere". GFSI's work in benchmarking and harmonization aims to foster mutual acceptance of GFSI-recognized certification programs across the industry, with the ambition to enable a "once certified, accepted everywhere" approach.

ISO/IEC 27001 is an international standard to manage information security. The standard was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005, revised in 2013, and again most recently in 2022. There are also numerous recognized national variants of the standard. It details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) – the aim of which is to help organizations make the information assets they hold more secure. Organizations that meet the standard's requirements can choose to be certified by an accredited certification body following successful completion of an audit. A SWOT analysis of the ISO/IEC 27001 certification process was conducted in 2020.

eCOGRA is a London-based testing agency and standards organisation in the realm of online gambling. The company was established in 2003 in the United Kingdom at the behest of the online gaming industry as the first industry self-regulation system. eCOGRA is a testing laboratory, inspection body, and certification body, specializing in the certification of online gaming software and the audit of Information Security Management Systems.

<span class="mw-page-title-main">Standardisation Testing and Quality Certification</span> Science and technology agency of the Government of India

Standardisation Testing and Quality Certification (STQC) Directorate, established in 1980, is an authoritative body offering quality assurance services to IT and Electronics domains.

References

  1. ↑ Coughlan, Shane (2022). "Transforming the Supply Chain with Openchain Iso 5230". Open Source Law, Policy and Practice. pp. 141–C6.P28. doi:10.1093/oso/9780198862345.003.0006. ISBN   978-0-19-886234-5.
  2. ↑ McClurg, John (May 2022). "A New Level of Trust: Corporate-Wide OpenChain ISO/IEC 5230:2020 Conformance". Security. Vol. 59, no. 5. Troy. p. 25. ProQuest   2666597005.
  3. ↑ "Toyota Is The First Company To Announce Adoption Of ISO/IEC 5230, The International Standard For Open Source Compliance" (Press release). 15 December 2020. ProQuest   2470636334.
  4. ↑ "Liferay Announces OpenChain Conformance". Investment Weekly News. 16 November 2019. p. 354. ProQuest   A605360074.
  5. ↑ Möbus, Maika (2021-10-20). "Open Source: Eclipse Foundation erreicht OpenChain-Konformität". Heise online. Retrieved 2022-11-24.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.