FOSS Contribution Principles Catalog
Foundational principles guiding employee contribution to Free and Open Source Software (source).
Governance
Principles for how FOSS contribution activity is directed and overseen.
ospo-governanceCentralized OSPO Governance
The Open Source Program Office establishes, evolves, and executes FOSS contribution strategy and governance under direction of the guidelines owner.
evidence-based-complianceEvidence-Based Compliance
Governance processes must produce evidence of approvals, reviews, scanning, identity use, and lifecycle decisions.
regulatory-alignmentAlignment With Applicable Regulations
FOSS contribution activity must remain aligned with export control, cross-border data flow, conduct, and other applicable regulatory and company policy obligations.
Risk and Value
Principles balancing business benefit against organizational risk.
company-benefitContribute When There Is Company Benefit
The company supports FOSS contribution when doing so benefits the company and does not present unacceptable risk.
acceptable-riskManage Unacceptable Risk
Preventative and detective controls must address risks that apply to FOSS contribution activity, including project-specific risks.
Conduct and Separation
Principles for appropriate employee conduct and separation of personal from company activity.
separation-personal-companySeparation of Personal and Company Activity
Personal FOSS contributions must be distinguishable from company contributions in identity, infrastructure, representation, and intellectual property use.