Sponsor: Fossa

Using open source comes with a set of obligations — as well as risks. As open source software continues to be adopted at an increasing rate, compliance with open source licenses becomes a more pressing initiative. Mitigating IP Risk: Three Strategies to Ensure Open Source Compliance discusses:

• Different types of risks associated with open source licenses

• Top approaches to mitigating risk in open source

• Pros and cons of manual open source audits

• Contrasts between semi-automated and continuous compliance

• Emerging trends in mitigating open source risk

Irresponsible usage of open source could result in litigation risk, lowered valuation, loss of market opportunity and damaged reputation which could impact sales and the recruitment of top talent. Three approaches to mitigating risk in using open source include manual audits, semi-automated compliance and continuous compliance. There are pros and cons to each approach, but continuous compliance fits best for companies leveraging agile development methodologies, DevOps and CI/CD technology tools.

Using open source comes with a set of obligations — as well as risks. As open source software continues to be adopted at an increasing rate, compliance with open source licenses becomes a more pressing initiative. Mitigating IP Risk: Three Strategies to Ensure Open Source Compliance discusses:

• Different types of risks associated with open source licenses

• Top approaches to mitigating risk in open source

• Pros and cons of manual open source audits

• Contrasts between semi-automated and continuous compliance

• Emerging trends in mitigating open source risk

Irresponsible usage of open source could result in litigation risk, lowered valuation, loss of market opportunity and damaged reputation which could impact sales and the recruitment of top talent. Three approaches to mitigating risk in using open source include manual audits, semi-automated compliance and continuous compliance. There are pros and cons to each approach, but continuous compliance fits best for companies leveraging agile development methodologies, DevOps and CI/CD technology tools.

Increasing demands from engineering and product development are offering an opportunity for legal to impact the business through the development of skills they need to partner effectively with internal technology teams.

• The definition of the "Product Counsel" role within your corporate counsel

• How to know if open source compliance is something you need to track

• What legal should focus on in partnership with internal tech teams

• The pains and priorities of legal's partners across the tech team

• Emerging trends in corporate legal service delivery

One of the emerging domains the General Counsel must support is engineering and product development. Not only tasked with bringing efficiency into the legal organization, but many now also embed a “Product Counsel” within Engineering, IT, Product, and Design teams to help make crucial, risk mitigating decisions that shape the strategic direction of the company’s product.

Tasked with automating developer workflow, the DevOps team has a growing amount of responsibilities — especially when it comes to ensuring that the open source software used at a company is secure and compliant. DevOps and Open Source 101: The DevOps Role in Modernizing Open Source Best Practices discusses:

• Modern software development practices and their reliance on open source

• The origin and evolution of DevOps, and the impact of open source on the role

• Deployment, continuous compliance and risk management

• Incorporating open source management into CI/CD

With each open source project, security and compliance need to be vetted. Security is an obvious concern, but open source license compliance is also essential because a lack of compliance to otherwise “free” open source tools can have a revenue impact when proof is required for enterprise sales, M&A, IPO or distribution on application platforms.

Open source is now a key part of any software strategy, with 77% of Enterprises including open source in commercial products. To ensure your company can reap the benefits from a rapid adoption of open source technologies, you need to have a strategy to manage your open source consumption responsibility. Creating an Open Source Compliance Program: Auditing Your Company’s Use of Open Source discusses:

• The checklist you need to create, run and maintain an Open Source Compliance program

• The creation of your Open Source Compliance policies

• Initiating your compliance program rollout

• Iterating and expanding your program across new products and business units

FOSSA has partnered with leaders in open source from foundations like OpenChain and Open Source Program Office experts from companies like Uber, Verizon Media, Ford, and TDAmeritrade to assemble and share these best practices in developing open source compliance programs.

Open source software is fundamentally different from proprietary software. Often, different teams use and/or build open source differently. Because of this variability, it needs to be approached differently. Managing this strategy is the job of the OSPO (Open Source Program Office). But what is an OSPO? And how do you build one? The Rise of the Open Source Program Office discusses:

• Things to know when evaluating your need for an OSPO

• Areas managed by an OSPO

• Roles key to an OSPO's success

• The key pillars of a successful OSPO

• A list of resources to read if you want to build an OSPO

Managing your open source program is all about improving efficiency and decreasing risk. Determining factors such as which open source licenses are appropriate, whether or not your full-time employees should be contributing to a major open source project, and determining what components will best accelerate your products growth, quality, or security all have implications on both your product’s viability and competitiveness, how your internal resources are being used, and what the risk profile of your company. An OSPO helps to define your open source management strategy.

As the use of open source grows and deployment timelines shrink, management of open source is a growing concern that many organizations are struggling with handling effectively. Most organizations start off managing all of their open source dependencies in a spreadsheet. 5 Reasons Why Using Spreadsheets for Open Source Management is a Recipe for Disaster discusses:

• The process for managing open source software licenses with spreadsheets

• Trends in open source vs. proprietary software usage

• The 5 most common open source management "fails"

• Enterprise and industry trends in open source adoption

• Steps to take to move off of managing open source in spreadsheets

Management of software licenses is an exercise whose importance transcends events like an IPO or a merger/acquisition, as revenue could be impacted when potential clients complete their due diligence before a purchase or an online marketplace requires a report before releasing your app on their platform.

When software is deployed continuously, composition analysis for quality, compliance, and security within code needs to be managed strategically. Ensuring that the benefits of open source are not outweighed by risks, software developers and corporate counsel must align around tools and practices to help manage their open source code responsibly to drive business value. Building and Maintaining a Successful Open Source Management Strategy discusses:

• Software challenges including compliance, security and code quality

• Best practices for managing open source software

• Key goals of a successful open source management strategy

• Essential steps for achieving your open source goals

Developers choose to use open source code to accelerate development, but manual open source management counters the time-saving advantages that drew them to open source in the first place.

Increasing demands from engineering and product development are offering an opportunity for legal to impact the business through the development of skills they need to partner effectively with internal technology teams.

• The definition of the "Product Counsel" role within your corporate counsel

• How to know if open source compliance is something you need to track

• What legal should focus on in partnership with internal tech teams

• The pains and priorities of legal's partners across the tech team

• Emerging trends in corporate legal service delivery

One of the emerging domains the General Counsel must support is engineering and product development. Not only tasked with bringing efficiency into the legal organization, but many now also embed a “Product Counsel” within Engineering, IT, Product, and Design teams to help make crucial, risk mitigating decisions that shape the strategic direction of the company’s product.

Tasked with automating developer workflow, the DevOps team has a growing amount of responsibilities — especially when it comes to ensuring that the open source software used at a company is secure and compliant. DevOps and Open Source 101: The DevOps Role in Modernizing Open Source Best Practices discusses:

• Modern software development practices and their reliance on open source

• The origin and evolution of DevOps, and the impact of open source on the role

• Deployment, continuous compliance and risk management

• Incorporating open source management into CI/CD

With each open source project, security and compliance need to be vetted. Security is an obvious concern, but open source license compliance is also essential because a lack of compliance to otherwise “free” open source tools can have a revenue impact when proof is required for enterprise sales, M&A, IPO or distribution on application platforms.

Open source is now a key part of any software strategy, with 77% of Enterprises including open source in commercial products. To ensure your company can reap the benefits from a rapid adoption of open source technologies, you need to have a strategy to manage your open source consumption responsibility. Creating an Open Source Compliance Program: Auditing Your Company’s Use of Open Source discusses:

• The checklist you need to create, run and maintain an Open Source Compliance program

• The creation of your Open Source Compliance policies

• Initiating your compliance program rollout

• Iterating and expanding your program across new products and business units

FOSSA has partnered with leaders in open source from foundations like OpenChain and Open Source Program Office experts from companies like Uber, Verizon Media, Ford, and TDAmeritrade to assemble and share these best practices in developing open source compliance programs.

Open source software is fundamentally different from proprietary software. Often, different teams use and/or build open source differently. Because of this variability, it needs to be approached differently. Managing this strategy is the job of the OSPO (Open Source Program Office). But what is an OSPO? And how do you build one? The Rise of the Open Source Program Office discusses:

• Things to know when evaluating your need for an OSPO

• Areas managed by an OSPO

• Roles key to an OSPO's success

• The key pillars of a successful OSPO

• A list of resources to read if you want to build an OSPO

Managing your open source program is all about improving efficiency and decreasing risk. Determining factors such as which open source licenses are appropriate, whether or not your full-time employees should be contributing to a major open source project, and determining what components will best accelerate your products growth, quality, or security all have implications on both your product’s viability and competitiveness, how your internal resources are being used, and what the risk profile of your company. An OSPO helps to define your open source management strategy.

As the use of open source grows and deployment timelines shrink, management of open source is a growing concern that many organizations are struggling with handling effectively. Most organizations start off managing all of their open source dependencies in a spreadsheet. 5 Reasons Why Using Spreadsheets for Open Source Management is a Recipe for Disaster discusses:

• The process for managing open source software licenses with spreadsheets

• Trends in open source vs. proprietary software usage

• The 5 most common open source management "fails"

• Enterprise and industry trends in open source adoption

• Steps to take to move off of managing open source in spreadsheets

Management of software licenses is an exercise whose importance transcends events like an IPO or a merger/acquisition, as revenue could be impacted when potential clients complete their due diligence before a purchase or an online marketplace requires a report before releasing your app on their platform.

When software is deployed continuously, composition analysis for quality, compliance, and security within code needs to be managed strategically. Ensuring that the benefits of open source are not outweighed by risks, software developers and corporate counsel must align around tools and practices to help manage their open source code responsibly to drive business value. Building and Maintaining a Successful Open Source Management Strategy discusses:

Software challenges including compliance, security and code quality

Best practices for managing open source software

Key goals of a successful open source management strategy

Essential steps for achieving your open source goals

Developers choose to use open source code to accelerate development, but manual open source management counters the time-saving advantages that drew them to open source in the first place.