FOSS Contribution Policy
Policy scope, imported catalogs, mitigated risks, and assessment plans for employee FOSS contribution (source). Assessment plans below define how each control requirement is evaluated.
Assessment Plans
ap-foss-001-project-classificationfoss-ctl-001-project-classification.ar01
Inventory and SCM evidence showing all staff-associated contribution activity maps to a classified project record, with no contributions observed against unclassified projects.
manual-ospo-reviewIntent · Manual · manual ospo reviewautomated-inventory-checkBehavioral · Automated · automated inventory check
ap-foss-002-ospo-registrationfoss-ctl-002-ospo-registration.ar01
Evidence that OSPO inventory registration predates first observed contribution for each governed project engagement.
automated-inventory-checkBehavioral · Automated · automated inventory check
ap-foss-003-ospo-approvalfoss-ctl-003-ospo-approval.ar01
Evidence that no contribution activity occurred before recorded OSPO approval for company-moderated and company-interest-major projects.
manual-ospo-reviewIntent · Manual · manual ospo reviewautomated-inventory-checkBehavioral · Automated · automated inventory check
ap-foss-004-minor-project-manager-approvalfoss-ctl-004-minor-project-manager-approval.ar01
Evidence that active minor-project access has a current line-manager approval record and no unapproved access is in use.
workflow-approval-checkBehavioral · Automated · workflow approval check
ap-foss-005-approved-licensefoss-ctl-005-approved-license.ar01
Evidence that company-attributed contribution activity occurs only on projects with approved license status in the OSPO license inventory.
automated-license-checkBehavioral · Automated · automated license checkmanual-legal-reviewIntent · Manual · manual legal review
ap-foss-006-legal-reviewfoss-ctl-006-legal-review.ar01
Evidence that triggered license or contributor-agreement conditions have a corresponding Legal review disposition before contribution proceeds.
manual-legal-reviewIntent · Manual · manual legal review
ap-foss-007-ip-reviewfoss-ctl-007-ip-review.ar01
IP review workflow disposition approving contribution, with review date preceding the evaluated contribution activity.
manual-sponsor-reviewIntent · Manual · manual sponsor reviewmanual-legal-reviewIntent · Manual · manual legal review
ap-foss-008-data-leakage-reviewfoss-ctl-008-data-leakage-review.ar01
Aggregated evaluation outputs from secret scan, sensitive-data scan, and manual reviewer sign-off showing no uncleared prohibited disclosures.
automated-secret-scanBehavioral · Automated · automated secret scanautomated-sensitive-data-scanBehavioral · Automated · automated sensitive data scanmanual-reviewIntent · Manual · manual review
ap-foss-009-export-control-reviewfoss-ctl-009-export-control-review.ar01
Evidence that export-control triggers have a recorded review disposition before affected contribution activity is approved or published.
automated-crypto-detectionBehavioral · Automated · automated crypto detectionmanual-export-control-reviewIntent · Manual · manual export control review
ap-foss-010-approved-toolsfoss-ctl-010-approved-tools.ar01
Evidence that company-infrastructure contribution activity occurs only through OSPO-approved tooling with recorded compliance scan results.
automated-tooling-checkBehavioral · Automated · automated tooling checkautomated-scm-checkBehavioral · Automated · automated scm check
ap-foss-011-peer-reviewfoss-ctl-011-peer-review.ar01
Evidence that each company-moderated contribution has a recorded peer review with reviewer identity and approval timestamp.
automated-peer-review-checkBehavioral · Automated · automated peer review check
ap-foss-012-maker-checkerfoss-ctl-012-maker-checker.ar01
Evidence that contributor and reviewer identities differ on each governed contribution transaction.
automated-maker-checker-checkBehavioral · Automated · automated maker checker check
ap-foss-013-company-identityfoss-ctl-013-company-identity.ar01
Evidence that company-attributed public activity does not use internal usernames or internal email addresses.
automated-identity-checkBehavioral · Automated · automated identity check
ap-foss-014-personal-identityfoss-ctl-014-personal-identity.ar01
Evidence that personal contribution activity is not attributed to a company-associated public identity.
manual-reviewIntent · Manual · manual review
ap-foss-015-personal-infrastructurefoss-ctl-015-personal-infrastructure.ar01
Contributor attestation and review records showing no indication of company-owned, company-managed, or company-network infrastructure use.
contributor-attestationIntent · Manual · contributor attestation
ap-foss-016-security-policyfoss-ctl-016-security-policy.ar01
Repository evidence that active company-moderated projects publish OSPO-approved vulnerability reporting instructions.
repository-file-checkBehavioral · Automated · repository file checkmanual-ospo-reviewIntent · Manual · manual ospo review
ap-foss-017-annual-trainingfoss-ctl-017-annual-training.ar01
Training records showing all active FOSS participants have current annual training completion on file.
training-record-checkBehavioral · Automated · training record check
ap-foss-018-annual-recertificationfoss-ctl-018-annual-recertification.ar01
Evidence that all active engagements have annual recertification within the required review period.
recertification-workflow-checkBehavioral · Automated · recertification workflow check
ap-foss-019-risk-change-reviewfoss-ctl-019-risk-change-review.ar01
Evidence that detected material risk changes are recorded in the FOSS inventory with OSPO or SME disposition.
inventory-change-monitoringBehavioral · Automated · inventory change monitoringmanual-ospo-reviewIntent · Manual · manual ospo review
ap-foss-020-retirementfoss-ctl-020-retirement.ar01
Evidence that retired or withdrawn engagements have no remaining active contribution entitlements in OSPO-approved tooling.
inventory-status-checkBehavioral · Automated · inventory status checkentitlement-reviewBehavioral · Automated · entitlement review