This document discusses continual improvement of open source license compliance programs. It suggests that companies can refine their compliance programs after adopting the OpenChain ISO 5230 standard in several steps such as adding a software bill of materials, automation tools, and independent auditing processes. Companies are encouraged to consider their size, organization, and market to determine the best path for evolving their compliance program. Asking questions about current processes and goals can help identify effective next steps.

1. An exploration of continual improvement around open
source license compliance programs

2. OpenChain ISO 5230 Is Spreading Rapidly

3. Our goal of “raising all the boats” in the
supply chain is well underway

4. We can also support continual improvement around
open source compliance programs

5. The OpenChain Project can provide case studies to help
guide company evolution in this space

6. This means a company has adopted the gold standard
in compliance processes management
OpenChain ISO 5230
is the most important step
towards excellence
6

7. 7
Program evolution flows naturally from this.
Way of Improvement Place of the Way
(dōjō)
(kaisen)

8. Choices depend on company size, organizational
approach, and market sector
There Are Many Paths Of Evolution Possible

9. There are no universal solutions but there are plenty of
case studies and examples to help your journey

10. Use OpenChain ISO 5230
Use Software bill of Materials
Use Automation
Have Audit Processes
Use OpenChain ISO 5230
Use Software bill of materials
10
An example of Company X refining a program:
Use OpenChain ISO 5230
Use OpenChain ISO 5230
Use Software bill of Materials
Use Automation
What Works
For Me?

11. ü OpenChain ISO 5230 processes working fine
Company X refining compliance
program after adoption of
OpenChain ISO 5230 – Starting Point
Expanding The Example Of Company X

12. ü OpenChain ISO 5230 processes working fine
ü Adds SPDX as a software bill of materials
Company X refining compliance
program after adoption of
OpenChain ISO 5230 – Step #1
Expanding The Example Of Company X

13. ü OpenChain ISO 5230 processes working fine
ü Adds SPDX as a software bill of materials
ü Adds FOSSology or ORT to check outbound
software
Company X refining compliance
program after adoption of
OpenChain ISO 5230 – Step #2
Expanding The Example Of Company X

14. ü OpenChain ISO 5230 processes working fine
ü Adds SPDX as a software bill of materials
ü Adds FOSSology or ORT to check outbound
software
ü Adds independent audit process
Company X refining compliance
program after adoption of
OpenChain ISO 5230 – Step #3
Expanding The Example Of Company X

15. Success is all about exploring your current situation
and understanding where you want to go
Application In The Real World

16. ü Will a software bill of materials make it
easier to manage the supply chain?
ü Will automation make the compliance
program more effective?
ü Is there a way to audit the efficiency of
the program over time?
Here are some examples
Ask Questions To Find What Is Right For You

17. ü Do you use a software bill of materials?
ü Do you have automation in your compliance
program?
ü Do you have a way to audit the health of the
program over time?
Here are some examples
Ask Questions To Help Your Suppliers

18. Context – Requirements – Implementation
Collaboration with your
peers will provide the
solution for your space
18