FOSS Contribution Controls Catalog

Threat-informed controls for governing employee FOSS contribution, with testable assessment requirements (source).

ControlCatalogv0.1.0draft

Threat-informed controls for governing employee contribution to Free and Open Source Software projects.

Showing 20 of 20

Governance and Classification

Controls for classifying contribution activity and establishing OSPO governance boundaries.

foss-ctl-001-project-classificationFOSS Project Category Classification

Objective

Ensure every employee FOSS contribution activity is classified into one of four project categories and that governed contribution does not proceed without the correct category on record.

Assessment Requirements

foss-ctl-001-project-classification.ar01
Staff-associated contribution activity MUST NOT occur against FOSS projects that lack a recorded category classification in the OSPO inventory system of record.
Applicability: all-contributions
Recommendation: Compare staff SCM identities, pull requests, and commits against OSPO inventory records; every observed engagement must map to one of: company-moderated, company-interest-major, company-interest-minor, or personal-contribution.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity

Guidelines foss-contribution-guidance

foss-guidance-project-categories

Registration and Approval

Controls for inventory registration, OSPO approval, and line manager authorization.

foss-ctl-002-ospo-registrationOSPO Inventory Registration

Objective

Assessment Requirements

foss-ctl-002-ospo-registration.ar01
Staff-associated contribution activity for company-moderated or company-interest projects MUST NOT occur unless a corresponding OSPO inventory registration predates that activity.
Applicability: company-moderatedcompany-interest
Recommendation: Verify inventory creation timestamps precede first observed contribution for each governed project engagement.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity

Guidelines foss-contribution-guidance

foss-guidance-inventory-registration

foss-ctl-003-ospo-approvalOSPO Project Approval

Objective

Obtain OSPO approval before contributions to governed high-impact projects.

Assessment Requirements

foss-ctl-003-ospo-approval.ar01
Contribution activity MUST NOT be observed for company-moderated or company-interest-major projects that lack a recorded OSPO approval in the inventory system of record.
Applicability: company-moderatedcompany-interest-major
Recommendation: Check inventory approval status before evaluating SCM activity for governed high-impact projects.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity

Guidelines foss-contribution-guidance

foss-guidance-ospo-project-approval

foss-ctl-004-minor-project-manager-approvalLine Manager Approval for Minor Projects

Objective

Require line manager approval for company-interest-minor contribution access.

Assessment Requirements

foss-ctl-004-minor-project-manager-approval.ar01
Active company-interest-minor contribution access MUST NOT exist without a recorded line-manager approval in an OSPO-approved tool.
Applicability: company-interest-minor
Recommendation: Validate workflow approval records for each active minor-project access grant.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity
employee-conflict-of-interest

Guidelines foss-contribution-guidance

foss-guidance-minor-project-access

Legal and License Compliance

Controls for license approval, legal review, and contributor agreement assessment.

foss-ctl-005-approved-licenseApproved FOSS License

Objective

Ensure contribution activity is associated with an OSPO-approved license.

Assessment Requirements

foss-ctl-005-approved-license.ar01
Company-attributed contribution activity MUST NOT occur against projects whose license is not recorded as approved for contribution in the OSPO license inventory.
Applicability: company-attributed
Recommendation: Compare project SPDX or license identifiers against the OSPO license inventory before evaluating contribution activity.

Threats foss-contribution-threat-catalog

unapproved-license-contribution

Guidelines foss-contribution-guidance

foss-guidance-license-inventory

foss-ctl-006-legal-reviewLegal Review for License and Contributor Agreements

Objective

Obtain legal review when licenses or contributor agreements require assessment.

Assessment Requirements

foss-ctl-006-legal-review.ar01
Company-attributed contribution activity MUST NOT proceed when triggered license or contributor-agreement conditions are present unless a recorded Legal review disposition exists in the system of record.
Applicability: company-attributed
Recommendation: Trigger on unapproved licenses, license changes, and CLA, CCLA, DCO, or equivalent contributor agreement requirements.

Threats foss-contribution-threat-catalog

contributor-agreement-exposure
unapproved-license-contribution

Guidelines foss-contribution-guidance

foss-guidance-legal-support

foss-ctl-007-ip-reviewIntellectual Property Review

Objective

Review contributions for intellectual property and competing-interest concerns before publication.

Assessment Requirements

foss-ctl-007-ip-review.ar01
Recorded intellectual-property review disposition MUST approve contribution before company-attributed activity is observed.
Applicability: company-attributed
Recommendation: Verify review records for each project engagement and material contribution before publication.

Threats foss-contribution-threat-catalog

intellectual-property-disclosure
asset-financial-write-down

Guidelines foss-contribution-guidance

foss-guidance-ip-review

Information Protection

Controls for preventing disclosure of non-public or sensitive information.

foss-ctl-008-data-leakage-reviewNon-Public Information Review

Objective

Prevent disclosure of non-public information through FOSS contributions.

Assessment Requirements

foss-ctl-008-data-leakage-review.ar01
Pre-publication evaluation outputs MUST report no uncleared prohibited disclosures before contribution content is published.
Applicability: all-contributions
Recommendation: Use secret scanning, sensitive-data detection, and reviewer sign-off before publication; treat uncleared findings as non-compliance.

Threats foss-contribution-threat-catalog

sensitive-data-disclosure

Guidelines foss-contribution-guidance

foss-guidance-information-classification

Export and Cross-Border Compliance

Controls for export-control and cross-border contribution review.

foss-ctl-009-export-control-reviewExport-Control Review

Objective

Assess contributions involving export-sensitive functionality before approval.

Assessment Requirements

foss-ctl-009-export-control-review.ar01
Contribution activity involving detected export-control triggers MUST NOT be approved or published without a recorded export-control review disposition.
Applicability: company-attributed
Recommendation: Trigger on non-standard cryptography, non-standard authentication mechanisms, and other export-sensitive functionality indicators.

Threats foss-contribution-threat-catalog

export-control-violation

Guidelines foss-contribution-guidance

foss-guidance-export-control

Infrastructure and Tooling

Controls for approved tooling and compliance scanning on company infrastructure.

foss-ctl-010-approved-toolsApproved Tools and Compliance Scanning

Objective

Require OSPO-approved tooling and compliance scanning when contributing from company infrastructure.

Assessment Requirements

foss-ctl-010-approved-tools.ar01
Contribution activity observed from company-managed hardware or the company network MUST NOT occur outside OSPO-approved tooling or without recorded compliance scanning results.
Applicability: company-infrastructure
Recommendation: Correlate SCM activity with approved tool inventory and scan logs for license, maker-checker, sensitive-data, copyright, and export checks.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity
sensitive-data-disclosure

Guidelines foss-contribution-guidance

foss-guidance-standard-tools
foss-guidance-company-infrastructure

Contribution Review

Controls for peer review and separation of duties.

foss-ctl-011-peer-reviewPeer Review Record

Objective

Maintain auditable peer review records for company-moderated contributions.

Assessment Requirements

foss-ctl-011-peer-review.ar01
Each company-moderated contribution MUST have a recorded peer review showing reviewer identity and approval date in the transaction history.
Applicability: company-moderated
Recommendation: Inspect pull-request or equivalent review records for every merged or published company-moderated change.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity
reputational-harm-from-contribution

Guidelines foss-contribution-guidance

foss-guidance-peer-review

foss-ctl-012-maker-checkerMaker-Checker Separation

Objective

Enforce separation of duties between contributor and reviewer.

Assessment Requirements

foss-ctl-012-maker-checker.ar01
Peer review records MUST NOT show the same identity as both contributor and reviewer where company controls apply.
Applicability: company-attributed
Recommendation: Compare contributor and reviewer identities on each governed contribution transaction.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity

Guidelines foss-contribution-guidance

foss-guidance-peer-review

Identity and Separation

Controls for proper public identity use and personal contribution boundaries.

foss-ctl-013-company-identityCompany External Identity

Objective

Require proper company external identity for attributed contributions.

Assessment Requirements

foss-ctl-013-company-identity.ar01
Company-attributed contribution activity MUST NOT be publicly attributed to internal usernames or internal email addresses.
Applicability: company-attributed
Recommendation: Verify commits, pull requests, and platform profiles use company external email identities for attributed contributions.

Threats foss-contribution-threat-catalog

identity-misattribution

Guidelines foss-contribution-guidance

foss-guidance-foss-identity

foss-ctl-014-personal-identityPersonal Contribution Identity

Objective

Prevent company-associated identity use for personal contributions.

Assessment Requirements

foss-ctl-014-personal-identity.ar01
Personal contribution activity MUST NOT be publicly attributed to a company-associated identity or represented as acting on behalf of the company.
Applicability: personal-contribution
Recommendation: Review public platform identities used for personal engagements during periodic personal-contribution reviews.

Threats foss-contribution-threat-catalog

identity-misattribution

Guidelines foss-contribution-guidance

foss-guidance-personal-contribution

foss-ctl-015-personal-infrastructurePersonal Contribution Infrastructure

Objective

Restrict personal contributions to non-company infrastructure.

Assessment Requirements

foss-ctl-015-personal-infrastructure.ar01
Recorded personal contribution engagements MUST NOT indicate use of company-owned hardware, company-managed hardware, or the company network.
Applicability: personal-contribution
Recommendation: Collect contributor attestation and investigate indicators of company-infrastructure use during personal-contribution reviews.

Threats foss-contribution-threat-catalog

identity-misattribution
employee-conflict-of-interest

Guidelines foss-contribution-guidance

foss-guidance-personal-contribution
foss-guidance-company-infrastructure

Security and Engagement Operations

Controls for vulnerability reporting and engagement maintenance.

foss-ctl-016-security-policyVulnerability Reporting Instructions

Objective

Publish OSPO-approved security vulnerability reporting instructions for company-moderated projects.

Assessment Requirements

foss-ctl-016-security-policy.ar01
Each active company-moderated project repository MUST contain published, OSPO-approved instructions describing how to report security vulnerabilities.
Applicability: company-moderated
Recommendation: Check for SECURITY.md or equivalent approved reporting instructions in the default branch of active repositories.

Threats foss-contribution-threat-catalog

reputational-harm-from-contribution

Guidelines foss-contribution-guidance

foss-guidance-vulnerability-reporting

Lifecycle and Training

Controls for contributor training, recertification, risk-change review, and project retirement.

foss-ctl-017-annual-trainingAnnual FOSS Contributor Training

Objective

Ensure contributors complete role-appropriate FOSS training annually.

Assessment Requirements

foss-ctl-017-annual-training.ar01
Employees with active FOSS contribution activity MUST have a current annual training completion record on file appropriate to their role.
Applicability: all-contributions
Recommendation: Compare training-system records against the population of active contributors, administrators, maintainers, and sponsors.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity
reputational-harm-from-contribution

Guidelines foss-contribution-guidance

foss-guidance-training

foss-ctl-018-annual-recertificationAnnual Engagement Recertification

Objective

Recertify FOSS engagements and access requests at least annually.

Assessment Requirements

foss-ctl-018-annual-recertification.ar01
Active company-moderated and company-interest engagements MUST have a recorded annual recertification within the required review period.
Applicability: company-interestcompany-moderated
Recommendation: Verify recertification timestamps, access status, license status, and continued business need for each active engagement.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity
employee-conflict-of-interest

Guidelines foss-contribution-guidance

foss-guidance-engagement-maintenance

foss-ctl-019-risk-change-reviewMaterial Risk Change Review

Objective

Record and review material changes in FOSS project risk.

Assessment Requirements

foss-ctl-019-risk-change-review.ar01
Detected material risk changes MUST NOT remain unrecorded in the FOSS inventory without OSPO or SME disposition.
Applicability: company-interestcompany-moderated
Recommendation: Monitor for license changes, inactivity, export-control impact, cross-border impact, and project retirement signals.

Threats foss-contribution-threat-catalog

unapproved-license-contribution
export-control-violation

Guidelines foss-contribution-guidance

foss-guidance-risk-change-management

foss-ctl-020-retirementFOSS Engagement Retirement

Objective

Transition, archive, or decommission retired FOSS engagements and remove contribution entitlements.

Assessment Requirements

foss-ctl-020-retirement.ar01
Retired, archived, or withdrawn FOSS engagements MUST NOT retain active contribution entitlements in OSPO-approved tooling.
Applicability: company-interestcompany-moderated
Recommendation: Verify inventory retirement status, repository transition or archive records, and entitlement removal in approved SCM and workflow tools.

Threats foss-contribution-threat-catalog

ungoverned-contribution-activity

Guidelines foss-contribution-guidance

foss-guidance-project-retirement