ISO/IEC 5230

Last updated

OpenChain ISO/IEC 5230:2020 is an international standard on the key requirements for a high-quality open source license compliance program. The standard was published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in late 2020. The standard is based on the Linux Foundation OpenChain Specification 2.1. It focuses on software supply chains, easier procurement and license compliance. Organizations that meet the requirements of the standard can self-certify to ISO/IEC 17021, from an accredited certification body or after successfully completing an audit. [1] [2] [3] [4]

Contents

How the standard works

Most organizations and software products rely on numerous open source components made by third parties, such as frameworks, libraries and containers, coming from diverse and often unaffiliated sources. This is akin to a supply chain in a brick-and-mortar environment and making sure the supply chain is as reliable as possible is considered important from an operational, legal and security standpoint. Upon this premise, a number of players have decided to establish the ground rules for an organization to deal with open source software at whichever level of the supply chain they operate. A working group under the umbrella of the Linux Foundation, the OpenChain project. Later, when reaching the 2.0 version, the norms were presented for approval as an ISO/IEC standard.

According to the standard, in order to use open source components effectively, organization must be aware of and comply with all the components involved, the associated open source licenses, and obligations such as copyleft. ISO/IEC 5230 aims to establish a non-prescriptive common understanding of what needs to be addressed within a quality open source compliance program. This makes ISO/IEC 5230 applicable across many industries and organizations and provides benefits to procurement and software supply chains, as open source software tends to be very cumbersome in legal contracts and procurement.

The main topics covered by ISO/IEC 5230 and OpenChain-2.1 are:

ISO/IEC 5230 does not define how exactly most of the tasks are to be performed, such as whether snippet scanning, revalidation of declared open source licenses is required, and what the compliance artifacts should look like. However, SPDX is now an ISO standard (ISO/IEC 5962) and is mentioned in ISO/IEC 5230 as an example of compliance artifacts.

Certification

The OpenChain ISO/IEC 5230 Specification identifies the key requirements of a quality open source compliance program. OpenChain Conformance allows organizations to show they meet these requirements. Certification of compliance with ISO/IEC 5230 can be reached in three ways providing a path for organizations of all sizes and program maturity.

Self-certification

The OpenChain community provides a free online self-assessment checklist that organizations can use to assess their compliance with the OpenChain Specification. The questionnaire covers various aspects of an organization's software supply chain management practices, including policies, procedures, and documentation related to open source compliance.

Using the OpenChain self-assessment questionnaire, an organization can evaluate the effectiveness and completeness of its open source compliance program, identify areas for improvement, and take corrective actions. The questionnaire can also be used as a tool for internal health checks to regularly assess and maintain the organization's compliance program.

Once an organization completes the self-assessment questionnaire, it can choose to submit its results for publication on the OpenChain website. However, the progress and results of the assessment are private until the organization decides to announce their conformance publicly. This allows organizations to conduct a thorough self-assessment of their open source compliance program without publicizing any potential issues or gaps in their compliance efforts.

Independent assessment

An independent assessment of a high-quality open source compliance program may be performed for additional assurance, accountability, separation of duty, and alignment with enterprise risk management.

An independent assessment is typically conducted by individuals within the organization or company but independent from the open source program under evaluation, or by individuals from an external organization or company. Components of an independent assessment may include the following:

  1. Self-Assessment Questionnaire: The self-assessment questionnaire is a set of questions that helps an organization assess its compliance with the OpenChain Specification. The questionnaire covers various aspects of the organization's software supply chain management processes and practices.
  2. Documentation Review: The assessor will review the documentation that the organization has prepared to support its self-certification. This includes policies, procedures, guidelines, and other documentation related to the organization's software supply chain management practices.
  3. Interview: The assessor will conduct interviews with key personnel within the organization to gain a better understanding of the organization's software supply chain management practices. This helps the assessor to identify any gaps or weaknesses in the organization's compliance with the OpenChain Specification.
  4. Assessment Report: The assessor will prepare a report that documents the findings of the assessment. The report will identify any non-compliances with the OpenChain Specification and provide recommendations for addressing these non-compliances.
  5. Certification: If the organization has successfully demonstrated compliance with the OpenChain Specification, the assessor will issue a certificate of compliance. The certificate indicates that the organization has met the requirements of the OpenChain Specification and is authorized to use the OpenChain Conformance Mark.

Third-party certification

Third-Party Certification for OpenChain ISO/IEC 5230 can be carried out by an OpenChain Third-Party Certifier listed on the OpenChain Partners website. Optionally, third parties may be accredited certifiers by numerous registrars worldwide. These organizations may be referred to as certification bodies, registration bodies, assessment and registration bodies, certification/registration bodies, or registrars, depending on the country.

The certification process involves an external audit of an organization's open source compliance program against the requirements set out in ISO/IEC 5230. The initial certification is carried out in two stages, as defined in ISO/IEC 17021. The first stage is a review of the documentation of the open source compliance program, which evaluates the existence, design, and completeness of key documents such as the organization's open source policy, clearing process, and staffing. The second stage is an audit, where the open source compliance program is independently audited for evidence that it has been properly implemented, and is in operation. Passing this phase results in receiving a certificate from the external certification body which can be shared with interested parties and displayed on the company's websites.

After certification, the organization is required to maintain compliance with the standard set forth by applicable registration bodies, by undergoing periodic surveillance audits and recertification audits to confirm that the quality open source compliance program continues to function as specified and intended. These follow-up reviews or audits help the organization to identify areas for improvement and ensure that they continue to meet the requirements of the standard.

Overall, certification of compliance with ISO/IEC 5230 provides independent verification that an organization has implemented a high-quality open source compliance program and is committed to ongoing compliance with the standard. The certification process helps organizations to identify gaps in their compliance program and take corrective actions to improve their open source compliance practices.

Dissemination

On October 19, 2020, the Eclipse Foundation announced that it is the first open source foundation to be certified to ISO/IEC 5230. [5] Several companies, including SAP, Toshiba, Samsung Electronics and LG Electronics have publicly announced their conformance to OpenChain.

Source

First version of this article was translated from the article on German Wikipedia.

Related Research Articles

Conformance testing — an element of conformity assessment, and also known as compliance testing, or type testing — is testing or other activities that determine whether a process, product, or service complies with the requirements of a specification, technical standard, contract, or regulation. Testing is often either logical testing or physical testing. The test procedures may involve other criteria from mathematical testing or chemical testing. Beyond simple conformance, other requirements for efficiency, interoperability or compliance may apply. Conformance testing may be undertaken by the producer of the product or service being assessed, by a user, or by an accredited independent organization, which can sometimes be the author of the standard being used. When testing is accompanied by certification, the products or services may then be advertised as being certified in compliance with the referred technical standard. Manufacturers and suppliers of products and services rely on such certification including listing on the certification body's website, to assure quality to the end user and that competing suppliers are on the same level.

The ISO 9000 family is a set of five quality management systems (QMS) standards that help organizations ensure they meet customer and other stakeholder needs within statutory and regulatory requirements related to a product or service. ISO 9000 deals with the fundamentals of QMS, including the seven quality management principles that underlie the family of standards. ISO 9001 deals with the requirements that organizations wishing to meet the standard must fulfill. ISO 9002 is a model for quality assurance in production and installation. ISO 9003 for quality assurance in final inspection and test. ISO 9004 gives guidance on achieving sustained organizational success.

An open standard is a standard that is openly accessible and usable by anyone. It is also a prerequisite to use open license, non-discrimination and extensibility. Typically, anybody can participate in the development. There is no single definition, and interpretations vary with usage.

ISO/IEC/IEEE 12207Systems and software engineering – Software life cycle processes is an international standard for software lifecycle processes. First introduced in 1995, it aims to be a primary standard that defines all the processes required for developing and maintaining software systems, including the outcomes and/or activities of each process.

ISO/IEC 15504Information technology – Process assessment, also termed Software Process Improvement and Capability dEtermination (SPICE), is a set of technical standards documents for the computer software development process and related business management functions. It is one of the joint International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) standards, which was developed by the ISO and IEC joint subcommittee, ISO/IEC JTC 1/SC 7.

Software quality assurance (SQA) is a means and practice of monitoring all software engineering processes, methods, and work products to ensure compliance against defined standards. It may include ensuring conformance to standards or models, such as ISO/IEC 9126, SPICE or CMMI.

Accreditation is the independent, third-party evaluation of a conformity assessment body against recognised standards, conveying formal demonstration of its impartiality and competence to carry out specific conformity assessment tasks.

ISO/IEC 20000 is the international standard for IT service management. It was developed in 2005 by ISO/IEC JTC1/SC7 and revised in 2011 and 2018. It was originally based on the earlier BS 15000 that was developed by BSI Group.

<span class="mw-page-title-main">Product certification</span> Performance and quality assurance

Product certification or product qualification is the process of certifying that a certain product has passed performance tests and quality assurance tests, and meets qualification criteria stipulated in contracts, regulations, or specifications.

IEC 61508 is an international standard published by the International Electrotechnical Commission consisting of methods on how to apply, design, deploy and maintain automatic protection systems called safety-related systems. It is titled Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems.

Software asset management (SAM) is a business practice that involves managing and optimizing the purchase, deployment, maintenance, utilization, and disposal of software applications within an organization. According to ITIL, SAM is defined as “…all of the infrastructure and processes necessary for the effective management, control, and protection of the software assets…throughout all stages of their lifecycle.” Fundamentally intended to be part of an organization's information technology business strategy, the goals of SAM are to reduce information technology (IT) costs and limit business and legal risk related to the ownership and use of software, while maximizing IT responsiveness and end-user productivity. SAM is particularly important for large corporations regarding redistribution of licenses and managing legal risks associated with software ownership and expiration. SAM technologies track license expiration, thus allowing the company to function ethically and within software compliance regulations. This can be important for both eliminating legal costs associated with license agreement violations and as part of a company's reputation management strategy. Both are important forms of risk management and are critical for large corporations' long-term business strategies.

International standards in the ISO/IEC 19770 family of standards for IT asset management address both the processes and technology for managing software assets and related IT assets. Broadly speaking, the standard family belongs to the set of Software Asset Management standards and is integrated with other Management System Standards.

An environmental audit is a type of evaluation intended to identify environmental compliance and management system implementation gaps, along with related corrective actions. In this way they perform an analogous (similar) function to financial audits. There are generally two different types of environmental audits: compliance audits and management systems audits. Compliance audits tend to be the primary type in the US or within US-based multinationals.

<span class="mw-page-title-main">British Approvals Service for Cables</span>

British Approvals Service for Cables is an independent accredited certification body headquartered in Milton Keynes, United Kingdom. Here, the organization's dedicated testing laboratory also operates which is believed to be the largest of its type in Europe. BASEC was established in 1971 and principally provides product certification services for all types of cable and wire, ancillary products and management systems within the cable industry. The organization maintains operations throughout the world including Africa, Middle East, America, Asia and Europe.

The Global Food Safety Initiative (GFSI) is a private organization working as a "Coalition of Action" from The Consumer Goods Forum (CGF) bringing together retailers and brand owners (manufacturers) from across the CGF membership operating as multistakeholder governance with objective to create "an extended food safety community to oversee food safety standards for businesses and help provide access to safe food for people everywhere". GFSI's work in benchmarking and harmonisation aims to foster mutual acceptance of GFSI-recognized certification programmes across the industry with the ambition to enable a “once certified, accepted everywhere” approach.

ISO/IEC 27001 is an international standard to manage information security. The standard was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005, revised in 2013, and again most recently in 2022. There are also numerous recognized national variants of the standard. It details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) – the aim of which is to help organizations make the information assets they hold more secure. Organizations that meet the standard's requirements can choose to be certified by an accredited certification body following successful completion of an audit. The effectiveness of the ISO/IEC 27001 certification process and the overall standard has been addressed in a large-scale study conducted in 2020.

eCOGRA is a London-based testing agency and standards organisation in the realm of online gambling. The company was established in 2003 in the United Kingdom at the behest of the online gaming industry as the first industry self-regulation system. eCOGRA is a testing laboratory, inspection body, and certification body, specializing in the certification of online gaming software and the audit of Information Security Management Systems.

References

  1. ↑ Coughlan, Shane (2022). "Transforming the Supply Chain with Openchain Iso 5230". Open Source Law, Policy and Practice. pp. 141–C6.P28. doi:10.1093/oso/9780198862345.003.0006. ISBN   978-0-19-886234-5.
  2. ↑ McClurg, John (May 2022). "A New Level of Trust: Corporate-Wide OpenChain ISO/IEC 5230:2020 Conformance". Security. Vol. 59, no. 5. Troy. p. 25. ProQuest   2666597005.
  3. ↑ "Toyota Is The First Company To Announce Adoption Of ISO/IEC 5230, The International Standard For Open Source Compliance" (Press release). 15 December 2020. ProQuest   2470636334.
  4. ↑ "Liferay Announces OpenChain Conformance". Investment Weekly News. 16 November 2019. p. 354. ProQuest   A605360074.
  5. ↑ Möbus, Maika (2021-10-20). "Open Source: Eclipse Foundation erreicht OpenChain-Konformität". Heise online. Retrieved 2022-11-24.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.