This slide deck contains the material used in a lightning talk at the 2018 Linux Foundation Legal Summit

1. Processes Missing From OpenChain
OpenChain Project - The Linux Foundation
Available under the CC Attribution-NoDerivatives 4.0 International license.

2. Compliance – A gateway to access
2

3. Trustworthy compliance is not only internal
3

4. “How do I trust my open source supply chain?”
4

5. The OpenChain Specification defines the requirements
for a quality compliance program.
5

6. 6
Training
Policy
Process
Inbound Outbound

7. The goal is to build trust by having organizations
conformant with the OpenChain Specification.
7

8. What is missing?
8

9. OpenChain is not prescriptive about what each process
should contain
9

10. OpenChain identifies inflection points based on one
company having inbound, internal and outbound
processes
10

11. While non-prescriptive the project provides reference
processes, policies and training in this context
11

12. Is there room for processes to describe
inter-organizational interaction?
12

13. What channels of communication should be open
during procurement?
13

14. What channels of communication should be open
during support?
14

15. At what point does a standard become too complex?
15

16. Questions?
OpenChain Project - The Linux Foundation 16