Compliance FrameworksInternational
OpenChain ISO 5230
International standard for open source license compliance management programs.
International standard for open source license compliance management programs.
| Short name | OpenChain |
| Region | International |
| Country or scope | International |
| Sector | Open Source |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers OpenChain
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for OpenChain.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for OpenChain and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
OC-3-3-BOM Open Source Bill of Materials | The program must have a process to create and manage a bill of materials that includes each open source component in a supplied software release (ISO/IEC 5230:2020 §3.3, open source content review and approval) | Scan |
OC-3-3-LIC License Identification | Identified licenses of open source components must be reviewed against the intended distribution use case, which requires license information to be recorded per component (ISO/IEC 5230:2020 §3.3) | Scan |
OC-3-2-ART Compliance Artifact Preparation | The program must be able to prepare the compliance artifacts (notices, source offers) that identified licenses require, which presupposes each component is unambiguously identified (ISO/IEC 5230:2020 §3.2 / §3.4 compliance artifacts) | Scan |
OC-3-3-VER Component Version Tracking | License obligations frequently differ between versions of the same component, so the bill of materials must record the version of each open source component (ISO/IEC 5230:2020 §3.3 BOM management) | Scan |
OC-3-1-DOC Documented Program Evidence | The compliance program must produce documented evidence; a bill of materials with a document identifier and creation timestamp provides the auditable record for each release (ISO/IEC 5230:2020 §3.1 program foundation) | Scan |
OC-3-5-SUP Upstream Component Origins | Understanding open source community engagement and obligations requires knowing where each component comes from, i.e. its supplier or originating project (ISO/IEC 5230:2020 program requirements on external contributions/obligations) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
OC-3.1.1 | Establish a Written Open-Source Policy |
OC-3.1.2 | Define Roles and Responsibilities for OSS Compliance |
OC-3.2.1 | Demonstrate Competence of Program Participants |
OC-3.3.1 | Raise Awareness of Open-Source Obligations |
OC-3.4.1 | Maintain Documented Inbound and Outbound OSS Processes |
OC-3.5.1 | Verify Supplier Conformance to Open-Source Requirements |
OC-3.6.1 | Fulfill Distribution License Obligations |
Policy templates
Written for OpenChain:
- Open-Source License Compliance Policy (OpenChain ISO 5230)
- Open-Source Software Contribution Policy
And 22 from the standard set, adapted to OpenChain.