Training
No matter how excellent a policy and process a company has built, it will be useless if none of the company’s members pay attention to it. For the open source policy and open source compliance process to work effectively in a company, training its members is important.
A company must provide practical means, such as training and an internal wiki, so that all Program participants are aware that the organization has an open source policy and can carry out the necessary activities. Here, Program participants refers to all employees involved in the company’s software development, distribution, and contribution, including software developers, deployment engineers, and quality engineers.
Many companies publish their open source policy document on an internal wiki site so that any employee can check what is needed. In addition, they make training on the open source policy mandatory during new employee orientation and provide periodic training to Program participants annually or once every two years, so that all Program participants are aware of the existence of the open source policy. That is, a company should include such methods in its open source policy document, written as in the example below.
1. Training and Assessment
All Software Distribution participants must complete the mandatory open source
training provided on the [Learning Portal] every year.
This ensures familiarity with the open source policy, related training policy, and
how to look it up. Training records are retained on the [Learning Portal].
Building such a training environment allows a company to prepare the following evidence materials required by ISO/IEC 5230.
- 3.1.1.2 A documented procedure that makes Program participants aware of the existence of the open source policy (e.g., training, internal wiki, or other practical communication methods)
| Self Certification 1.b | Do you have a documented procedure that communicates the existence of the open source policy to all Software Staff? (e.g., via training, internal wiki, or other practical communication method) |
|---|---|
| Do you have a documented procedure that communicates the existence of the open source policy to all Software Staff? (e.g., via training, internal wiki, or other practical communication method) |
In addition, a company must make Program participants aware of the company’s open source policy, open source-related objectives, how participants can contribute to an effective open source program, and the implications of failing to comply with Program requirements. To do this, a company provides training and conducts an assessment to confirm that Program participants have understood correctly. The assessment results are documented and retained.
A company can include content such as the example below in its open source policy for this purpose.
1. Purpose
(1) Purpose of the policy
This policy provides the following principles so that the entire organization
involved in the company's software development, service, and distribution can
make proper use of open source.
1) Principles for performing compliance in consideration of open source licenses
2) Principles for contributing to external open source projects
3) Principles for releasing internal projects as open source
These principles provide a way for all members of the company to understand the
value of open source, use open source correctly, and contribute to the open
source community.
(2) Impact of non-compliance
Failure to comply with this policy may result in the following situations.
* Receiving demands from external parties for open source license compliance.
* Being forced to disclose company-developed source code against its wishes.
* Facing legal action from open source copyright holders.
* Being fined or receiving a product sales suspension order for copyright
infringement and breach of contract.
* Loss of company reputation.
* Breach of contract with suppliers, resulting in claims for damages.
For these reasons, the company takes violations of the open source policy
seriously, and members or organizations that violate it may be subject to
disciplinary action.
(3) How members can contribute
All members can contribute to the effectiveness of the policy and the
improvement of the company's compliance level by understanding the basis
and content of this policy and faithfully carrying out the necessary
activities.
Assessment is explained in more detail below.
Including such training content in the policy allows a company to prepare the following evidence materials required by ISO/IEC 5230.
- 3.1.3.1 Documented evidence indicating that the awareness of Program participants was assessed regarding: the objectives of the Program, how participants contribute within the Program, and the implications of failing to comply with the Program
| Self Certification 1.f | Do you have evidence documenting the awareness of your personnel of the following topics? i. The open source policy and where to find it ii. The relevant open source objectives iii. The contributions expected to ensure the effectiveness of the Program iv. The implications of failing to follow the Program requirements |
|---|---|
| Do you have evidence documenting the awareness of your personnel of the following topics? i - The open source policy and where to find it; ii - The relevant open source objectives; iii - The contributions expected to ensure the effectiveness of the Program; iv - The implications of failing to follow the Program requirements. |
Open source training also includes content about the open source contribution policy. Even if an open source contribution policy has been created, if internal members are unaware of its existence, there is a risk that indiscriminate contribution activities could cause harm to individuals and the company. Open source training is provided so that all internal developers are aware of the existence of the open source contribution policy.
Providing training on the contribution policy in this way allows a company to prepare the following evidence materials required by ISO/IEC 5230.
- 3.5.1.3 A documented procedure that makes all Program participants aware of the existence of the Open Source contribution policy (e.g., training, internal wiki, or other practical communication methods)
| Self Certification 5.c | Do you have a documented procedure that makes all Software Staff aware of the existence of the Open Source contribution policy? |
|---|---|
| Do you have a documented procedure that makes all Software Staff aware of the existence of the Open Source contribution policy? |
Creating new training materials from scratch can also be a difficult task for someone just starting this role. To help with this difficulty, NCSOFT published its internal open source training materials, including the lecture slides (PPT) and lecture script, on GitHub so anyone can use them.
In addition, Kakao, a leading domestic platform company, has also released its open source training materials for internal developers so that anyone can view them.
If training materials have not yet been created, using the open source training materials of these companies with excellent open source management practices is also a good option.
Assessment
Once a company has assigned personnel to each role, it must confirm that the assigned personnel are qualified to perform the role based on education, training, and experience. Training must also be provided to Program participants with insufficient competency so they can acquire sufficient competency. The company must also assess whether each participant has the necessary competency and retain the results.
- The company provides training so that each participant can acquire the required competency.
- An assessment is conducted based on the training content.
- The assessment results are retained by the company’s training system or HR department.
When there are several hundred or more Program participants, making training difficult to provide, using the company’s online training and assessment system is also a good option.
Such content can be included in a company’s open source policy as follows.
4. Roles, Responsibilities, and Competencies
To ensure the effectiveness of this policy, the roles, responsibilities, and the
competencies required of the person in charge of each role are defined as follows.
The organization/person in charge of each role and the required competency level
are defined in "Appendix 1. Personnel Roster".
5. Training and Assessment
All members responsible for each role defined in Chapter 4 must complete the
open source training provided on the [Learning Portal].
Training records and assessment results are retained on the [Learning Portal]
for at least three years.
Having such a training and assessment system in place allows a company to prepare the following evidence materials required by ISO/IEC 5230.
- 3.1.2.3 Documented evidence of assessed competence for each Program participant
| Self Certification 1.e | Have you documented evidence of assessed competence for each Program participant? |
|---|---|
| Have you documented evidence of assessed competence for each Program participant? |
Open Source License Guide
To properly comply with open source licenses, one must accurately know the requirements of each open source license. However, since it is difficult for individual software developers to grasp all of this, it is advisable for the Open Source Program Manager to organize the requirements and precautions for common use cases of frequently used open source licenses and share them internally within the company.
The open source license guide should include the requirements for common open source license use cases, enabling the development department to correctly comply with license obligations while using open source.
For general guidance on open source licenses and summarized license obligation materials, the License Guide provided by the Korea Copyright Commission can be referenced.
The License Obligations document in SK telecom’s open source guide is also a good resource.
https://sktelecom.github.io/guide/use/obligation/gpl-2.0/
Providing such an open source license guide allows a company to prepare the following evidence materials required by ISO/IEC 5230.
- 3.3.2.1 A documented procedure for handling common open source license use cases for open source components within Supplied Software
| Self Certification 3.c | Have you implemented a procedure that handles at least the following common open source license use cases for the open source components within each Supplied Software release? i - distributed in binary form; ii - distributed in source form; iii - integrated with other open source such that it may trigger copyleft obligations; iv - contains modified open source; v - contains open source or other software under an incompatible license interacting with other components within the Supplied Software |
|---|---|
| Have you implemented a procedure that handles at least the following common open source license use cases for the open source components of each supplied Supplied Software release? i - distributed in binary form; ii - distributed in source form; iii - integrated with other open source such that it may trigger copyleft obligations; iv - contains modified open source; v - contains open source or other software under an incompatible license interacting with other components within the Supplied Software; vi - contains open source with attribution requirements. |
Building the environment for training, assessment, and guide provision up to this point results in compliance with the ISO/IEC 5230 requirements as shown below.
