Skip to content

Update 04-chapter.md #592

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 22, 2025
Merged

Update 04-chapter.md #592

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
24841e7
Update 04-chapter.md
harmonyelendu Apr 21, 2025
254cc93
Update ospo-book/content/en/04-chapter.md
alice-sowerby Apr 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions ospo-book/content/en/04-chapter.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@

## Introduction

Once you have your strategy, you need a plan. Your plan will be to create and execute on a set of regular activities that deliver your strategy. This chapter will help you understand what the range of an OSPO’s activities are, and what value each one delivers to your org.
Once you have your strategy, you need a plan. Your plan will be to create and execute on a set of regular activities that deliver your strategy. This chapter will help you understand what the range of an OSPO’s activities are, and what value each one delivers to your organization.

## Common Activities

Expand Down Expand Up @@ -52,19 +52,19 @@
| Activities | Value for the OSPO | Value for the Organization |
| -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Define open source compliance rules and practices | An explicit consensus on the organization's open source compliance rules and practices between the legal and business stakeholders. | The organization knows that it has a managed approach to the legal aspects of open source consumption, which can be maintained and improved over time. Each company has different aspects of open source compliance, interpretations of licenses and different risk appetite (e.g dealing with regulations). Having well-defined compliance rules and practices is the first step toward deterministic open source compliance |
| Define rules and policies on using open source (criteria for using OSS which relate to open source health) | Consumption of open source projects isn't just viewed through the compliance lens, but is considered more holistically and includes the risks associated with unhealthy projects. A consensus is built in the company related to the hygiene related to consumed open source components. The organization has clear policies to follow. | Consumed open source projects are lower in risk because they're healthy, fixing security vulnerabilities, implementing new features and release regularly. |
| Define rules and policies on how to contribute to open source (criteria on how to engage in the community, how to transfer rights, Contributor License Agreements) | The OSPO can increase awareness of the two-way relationship with open source projects. Using policies supports a consistent and ethical approach. The organization has clear policies to follow. | Policies and practices ensure that the organization considers how to jointly build value with open source projects. Contributions made are likely to improve the company reputation, not damage it. |
| Adopt ISO/IEC 5230 (OpenChain) Compliance | The OSPO can implement an international, defined standard rather than creating one from the ground up. | The organization can demonstrate its compliance with an internationally recognized standard. |
| Manage an inventory of OSS used in the organization | The OSPO is aware of the surface area of OSS it's overseeing. | The organization has a base for overall risk management. This is an important tool for dealing with issues relating to specific projects (security problems, license changes, lifecycle issues, etc.) |
| Define rules and policies on using open source (criteria for using OSS which relate to open source health) | Consumption of open source projects isn't just viewed through the compliance lens, but is considered more holistically and includes the risks associated with unhealthy projects. A consensus is built in the company related to the hygiene of consumed open source components. The organization has clear policies to follow. | Consumed open source projects are lower in risk because they're healthy, fixing security vulnerabilities, implementing new features and release regularly. |
| Define rules and policies on how to contribute to open source (criteria on how to engage in the community, how to transfer rights, Contributor License Agreements) | The OSPO can increase awareness of the two-way relationship with open source projects. Using policies supports a consistent and ethical approach. The organization has clear policies to follow. | Policies and practices ensure that the organization considers how to jointly build value with open source projects. Contributions made are likely to improve the company's reputation, not damage it. |
| Adopt ISO/IEC 5230 (OpenChain) Compliance | The OSPO can implement an international, defined standard rather than create one from the ground up. | The organization can demonstrate its compliance with an internationally recognized standard. |
| Manage an inventory of OSS used in the organization | The OSPO is aware of the surface area of OSS it oversees. | The organization has a base for overall risk management. This is an important tool for dealing with issues relating to specific projects (security problems, license changes, lifecycle issues, etc.) |
| Training on open source awareness | Providing training on open source increases visibility of the role of open source, visibility of the OSPO and its value, and improves understanding of how the organization uses and engages with open source. | Increases the competence present in the organization to work with OSS through an awareness of open source value, licensing, and contributions etc. |
| Introduce tools for license compliance | Provide structure and visibility for licence compliance within the organization, which helps inform management strategy. | Automation is essential to be able to address risks with a reasonable amount of effort and measure effectiveness of efforts to improve compliance. |
| Clarify how to support OSS | Ensure that OSS is adopted with appropriate understanding of how it can be supported. | The organization should be aware of the hidden costs of using OSS in production scenarios. External support for open source components can sometimes be bought from a vendor or a service provider. Alternatively, other options are to managed the support yourself with the help of the community (being realistic in considering what a community can be expected to support), or going with the risk of not having support which may be appropriate for scenarios where the risk is low. |
| Clarify how to support OSS | Ensure that OSS is adopted with appropriate understanding of how it can be supported. | The organization should be aware of the hidden costs of using OSS in production scenarios. External support for open source components can sometimes be bought from a vendor or a service provider. Alternatively, other options are to manage the support yourself with the help of the community (being realistic in considering what a community can be expected to support), or going with the risk of not having support which may be appropriate for scenarios where the risk is low. |

#### STAGE: Participant

| Activities | Value for the OSPO | Value for the Organization |
| ---------------------------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------- |
| Financially supporting open source communities | Better relationship with communities, more influence. | Better stability in the ecosystem and software supply chain that the organization relies on. |
| Financially supporting open source communities | Better relationships with communities, more influence. | Better stability in the ecosystem and software supply chain that the organization relies on. |
| Membership of open source organizations | Membership benefits such as co-marketing, event discounts. | Engagement with the communities the organization relies on. Potential influence and access to strategically useful information. Supporting the ecosystem. |
| Trying InnerSource | Staff in the organization will get hands-on experience with open source methodologies, which builds awareness, understanding, and advocacy. | The organization will build skills in its workforce that will contribute to better use of, and engagement with, open source projects. |

Expand All @@ -73,7 +73,7 @@
| Activities | Value for the OSPO | Value for the Organization |
| -------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Create contribution policy and process | Managing open source contributions becomes easier. | Having clear procedures means that the organization can offer open source contributions in a legally safe way, for open source projects, the organization, and its employees. |
| Qualification of contributors | Contributors require less oversight and make good ambassadors. | Skilled contributors make better contributions into publicly-visible projects. This means less risk to the organization. |

Check failure on line 76 in ospo-book/content/en/04-chapter.md

View workflow job for this annotation

GitHub Actions / Review docs

"TODO.LyHyphens" 

'publicly-visible' doesn't need a hyphen.

#### STAGE: Leadership

Expand Down
Loading