Ana Jimenez Santamaria

Enabling continuity in executive support, funding, software development practices, and OSS project prioritization. Within organizations, Open Source Program Office’s role can include setting code use, distribution, selection, auditing, and other policies, as well as training developers, ensuring legal compliance, or promoting and building community engagement. OSPOs bring many benefits to both, the open source ecosystem and organizations in equal parts, yet sometimes, the path to follow is unclear. During this session, Ana will share a set of actionable tips based on the TODO community learnings that any organization can implement to start building their Minimal Viable OSPOs, as well as ways to overcome the ongoing challenges ( culture, tooling, process, and continuity). This talk welcomes any open source professional, CTO, or executives willing to catalyze their organization's open source operations and become better citizens in the open source development community.

Legal Risk Mitigation is one of the three main functions of an OSPO (designated places where open source is supported, nurtured, shared, explained, and grown inside an organization). OSPOs often oversee aspects of a company’s open source license compliance process and supply chain as one of the first activities. The responsibilities include:

• Maintaining open source license compliance reviews and oversight
• Running a review process for inbound code use
• Ensuring that the company contributes back to open source projects effectively

To a certain degree, any organization calling itself an OSPO likely indicates the organization has reached a maturity stage where Executive-level recognition that OSS is an important strategic asset and builds a critical mass of processes, procedures, and tools to streamline and facilitate open source consumption and participation across divisions. Indeed, these activities also include a wide range of software composition analysis solutions such as Software Bill of Materials (SBOM), license management scanning, or continuous monitoring tools.

While some OSPOs rely on Software composition analysis vendors like Synopsys and Tidelift, others decide to make their own built-in solutions. During this presentation, Ana Jimenez, PM at TODO group (an open community of organizations who run OSPOs worldwide), will introduce the evolution and expansion of OSPOs over the years from a supply chain perspective, some of the common SCA tooling used, as well as how OSPOs can contribute and nurture the ecosystem of SCA tools to adapt to the needs of the different industries.