This document discusses the increasing complexity of open source software use in corporate environments due to new rules and guidelines around software bills of materials and supply chain security. It notes that while open source is important for businesses, many companies have limited visibility into their software supply chains due to relying on spreadsheets rather than proper processes. Standards like OpenChain and upcoming ISO standards aim to provide best practices for open source license compliance and security assurance. Widespread adoption of these standards could help create a more predictable and secure software supply chain. The document outlines support and resources for organizations looking to implement these standards.

1. The State of Open
Source
Our Field in 2023

2. This talk focuses on practical
corporate use of open source
WARNING

3. Things Are Getting
Complex

4. There Are More Rules And Guidelines
● NTIA Minimum Requirements of Software Bill of Materials (SBOM)
● White House Executive Order – SBOM again
● Cyber Resiliency Act (CRA) in the European Union – Reporting and
Compliance Requirements

5. 5.5tn
Global Cost of Cyber Crime
Source – CRA Explanatory Materials

6. Open Source Reality – We Need To Do Better
● The inclusion of far more support for SBOMs is inevitable
● This implies better tooling and record keeping in companies and projects
● It also implies more coordination around standards
● Enhanced reporting and other compliance requirements are still TBD

7. Why

8. Our Mental Model Of The Supply Chain

9. The Actual Supply Chain

10. 67.4%
of managers monitor their supply chain with Excel spreadsheets
https://www.zippia.com/advice/supply-chain-statistics/

11. 94%
of companies do not have full visibility of their supply chain
https://www.zippia.com/advice/supply-chain-statistics/

12. https://www.zippia.com/advice/supply-chain-statistics/

13. Context: This Is Important To Business
13
Open Source License Compliance and Security Assurance
is a key part of supply chain management.

14. https://www.synopsys.com/blogs/software-security/open-source-trends-ossra-report/

15. Open Source Reality – We Are Doing Better
● The open source supply chain is still facing many challenges
● The key thing missing for many companies are the appropriate processes to
allow implementation of better, more efficient practices
● For example, before you can have an SBOM, you need a policy and you need
processes to support implementation
Policy, Processes and Training are key

16. Open Source Process Management
● In Market Q4 2016~ (de facto) Q4 2020 (ISO/IEC)
OpenChain ISO/IEC 5230:2020
The International Standard for open source license compliance.
● In Market Q4 2022~ (de facto) Q3 2023 projected (ISO/IEC)
ISO/IEC DIS 18974, OpenChain Security Assurance
Specification
The de facto standard for open source security assurance compliance.
1. High level process standards;
2. Simple, effective and suitable for companies of all sizes in all markets;
3. Openly developed by a vibrant user community and freely available to all.
16

17. The Standards Work Company By Company
Result = A More Predictable Supply Chain

18. Example Adoption Of
OpenChain ISO/IEC
5230:2020
18

19. 20%
of German companies with over 2,000 employees
already use OpenChain ISO/IEC 5230
https://www.pwc.de/en/digitale-transformation/pwc-bitkom-study-open-source-monitor-2021.pdf

20. Key Companies Supporting These Standards
20

21. Broader Community
Main Work Groups:
● Specification (Spring 2016~)
● Education (Autumn 2020~)
Community Work Groups:
● Tooling (Summer 2019~)
● Export Control (Winter 2022~)
● Public Policy (Winter 2022~)
Special Interest Groups:
● Automotive (Summer 2019~)
● Telecom (Spring 2021~)
Regional User Groups
● Japan (Dec 2017~)
● Korea (Jan 2019~)
● India (Sept 2019~)
● China (Sept 2019~)
● Taiwan (Sept 2019~)
● Germany (Jan 2020~)
● UK (June 2020~)
● USA (Dec 2020~)

22. 1. Self-Certification
2. Independent Assessment
3. Third-Party Certification
Freedom Of Choice In Adoption

23. Free Self-Certification Material
23

24. 11 Third-Party Certifiers Providing Global
Coverage

25. Free Online Training Courses
25
1. LFC193 - 1209 total enrollments (398 digital badges issued)
4.65 out of 5 rating by users
2. LFC194 - 579 total enrollments (138 digital badges issued)
4.55 out of 5 rating by users

26. Be Part Of This
https://www.openchainproject.org/participate