Understand Why Open Source Process Management Matters To InnerSource #InnerSourceSummit2025

Understand Why Open Source Process Management Matters To InnerSource #InnerSourceSummit2025 🔗 **Source:** [Understand Why Open Source Process Management Matters To InnerSource #InnerSourceSummit2025](https://www.youtube.com/watch?v=bfjL9bd5JE8) > [!note]+ Document Notes > tags: [innersource, opensource, process-management, governance, supply-chain, ISO-standards] > author: Shane Coughlan > source: InnerSource Commons > reference: https://www.youtube.com/watch?v=bfjL9bd5JE8 > date created: 2024-12-19 14:30 > > # 🏷️ Title: Understand Why Open Source Process Management Matters To InnerSource >  ## 🧰 Action Inbox - [H1] Explore OpenChain ISO standards for process management — free download available #process-management - [H2] Review OpenChain reference materials for inner source adaptation — CC0 licensed #resources - [H3] Connect with OpenChain community for collaboration — global ambassadors available #community ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [OpenChain Project](https://openchainproject.org) - [InnerSource Commons](https://innersourcecommons.org) ## 📝 Summary - Shane Coughlan from OpenChain argues that open source and inner source face fundamentally similar process management challenges - OpenChain has developed ISO standards for license compliance and security assurance that apply to both external and internal code sharing - The supply chain model reveals that internal organizational silos sharing code mirror external supply chain dynamics - Companies face identical risks and legal consequences whether code starts internally or externally, as internal code often becomes external - OpenChain offers freely available standards, reference materials, training, and community resources that inner source teams can leverage ## 📖 Main Content The OpenChain Project has spent nine years building process management standards for open source license compliance and security assurance, resulting in ISO standards that govern how organizations handle code in supply chains. Coughlan argues that the traditional distinction between inner source (internal IP) and open source (third-party IP) creates artificial boundaries when the underlying process challenges are identical. The core insight centers on supply chain dynamics: large organizations like Panasonic or Siemens have multiple legal entities and teams passing code between units, creating internal supply chains that mirror external ones. When teams share binary code internally, they face the same fundamental questions: What was passed? How was it passed? What are the compliance requirements? OpenChain addresses these challenges through process management rather than prescriptive solutions, focusing on identifying where processes need to exist rather than dictating specific implementations. Their ISO standards cover inbound, internal, and outbound processes, with internal processes being immediately applicable to inner source program offices. The project has created over 1,500 reference documents in 14 languages, all released under CC0 licensing for unrestricted use and modification. This includes maturity modeling, training materials, and guides covering emerging areas like AI system bill of materials and SBOM quality standards. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/bfjL9bd5JE8?t=0) — [H1] OpenChain Project Overview - Key idea: OpenChain works toward a more trusted supply chain through ISO standards - Evidence: "We want a more trusted supply chain... we're best known for our ISO standards" #### ⏱️ [02:15](https://youtu.be/bfjL9bd5JE8?t=135) — [H2] Community Scale and Industry Coverage - Key idea: OpenChain has massive global participation across all industry verticals - Evidence: "In Japan we have about 200 participants, in China about 360 participants" #### ⏱️ [03:45](https://youtu.be/bfjL9bd5JE8?t=225) — [H2] Industry Diversity in Community - Key idea: OpenChain crosses all industry verticals from consumer electronics to nuclear power - Evidence: "Whether people are doing consumer electronics or building nuclear power plants, we're part of what they do" #### ⏱️ [05:30](https://youtu.be/bfjL9bd5JE8?t=330) — [H1] Core Argument: Inner Source and Open Source Similarity - Key idea: Inner source and open source address very similar challenges despite different IP focuses - Evidence: "They're very very similar questions... shared goal of breaking down silos" #### ⏱️ [07:00](https://youtu.be/bfjL9bd5JE8?t=420) — [H1] Supply Chain Mental Model - Key idea: The reality of supply chains is chaos with lots of parties sharing code - Evidence: "Mental model... companies are interacting in organized manner. Reality is chaos and no one knows what's going on" #### ⏱️ [08:15](https://youtu.be/bfjL9bd5JE8?t=495) — [H1] Internal vs External Supply Chain Equivalence - Key idea: Internal organizational code sharing mirrors external supply chain dynamics - Evidence: "Supply chain is internal and external. It's actually the same thing from our perspective" #### ⏱️ [09:30](https://youtu.be/bfjL9bd5JE8?t=570) — [H2] Process Management Focus - Key idea: OpenChain focuses on high-level process management rather than implementation details - Evidence: "We stay up at the top area focusing on how do you frame management of this field" #### ⏱️ [10:45](https://youtu.be/bfjL9bd5JE8?t=645) — [H2] ISO Standards Accessibility - Key idea: OpenChain ISO standards are freely available through multiple channels - Evidence: "You can buy them off ISO web store... or just go to our website and get them there" #### ⏱️ [12:00](https://youtu.be/bfjL9bd5JE8?t=720) — [H2] Process Points Not Prescriptive - Key idea: Standards identify where processes need to exist rather than dictating how - Evidence: "They don't tell you how to do your job. They do tell you where something needs to be done" #### ⏱️ [13:30](https://youtu.be/bfjL9bd5JE8?t=810) — [H2] SBOM Quality Work Group Example - Key idea: OpenChain actively develops cross-industry guides for emerging challenges - Evidence: "Cross-industry SBOM quality guide... coming out in December" #### ⏱️ [15:00](https://youtu.be/bfjL9bd5JE8?t=900) — [H2] Global Ambassador Network - Key idea: OpenChain has ambassadors worldwide who can provide connections and expertise - Evidence: "Ambassadors all around the world... available to give friendly chat" #### ⏱️ [16:30](https://youtu.be/bfjL9bd5JE8?t=990) — [H1] CC0 Licensed Reference Materials - Key idea: All OpenChain reference materials are released for unrestricted use - Evidence: "We release it under CC0 so you can take it and do whatever you want" #### ⏱️ [18:00](https://youtu.be/bfjL9bd5JE8?t=1080) — [H2] Extensive Resource Library - Key idea: OpenChain maintains over 1,500 reference documents in 14 languages - Evidence: "Over 1,500 reference documents in 14 languages in our library" #### ⏱️ [20:15](https://youtu.be/bfjL9bd5JE8?t=1215) — [H2] AI System Bill of Materials - Key idea: OpenChain has developed guidance for AI-specific compliance challenges - Evidence: "Artificial intelligence system bill of materials compliance guide... worked on it for 18 months" #### ⏱️ [22:30](https://youtu.be/bfjL9bd5JE8?t=1350) — [H1] Market Evolution Toward Standardization - Key idea: Open innovation is becoming standardized like traditional software asset management - Evidence: "Getting closer to traditional software asset management. We literally have ISO standards" #### ⏱️ [24:00](https://youtu.be/bfjL9bd5JE8?t=1440) — [H1] Prediction: Inner Source Will Follow Open Source Path - Key idea: Inner source will follow the same trajectory as open source management - Evidence: "99% certainty you'll be going in same direction... 98% of what we've done is exactly what you will end up doing" #### ⏱️ [26:30](https://youtu.be/bfjL9bd5JE8?t=1590) — [H1] Community and Collaboration Values - Key idea: Working together between and within organizations represents the same fundamental principle - Evidence: "Working together works better... between organizations, inside an organization, it's all the same thing" ## 📚 References - [OpenChain Project Website](https://openchainproject.org) - [ISO Standards for Open Source License Compliance](https://www.iso.org/standard/81039.html) - [OpenChain Reference Materials](https://openchainproject.org/resources) - [InnerSource Commons](https://innersourcecommons.org) ## 🗣️ Paraphrase - OpenChain has developed internationally recognized process management standards for handling code in supply chains, addressing license compliance and security assurance through systematic approaches rather than prescriptive solutions - The fundamental challenges of managing code sharing are identical whether the code originates internally (inner source) or externally (open source), because internal code frequently becomes external and organizational silos mirror supply chain dynamics - Organizations can leverage OpenChain's nine years of community development, including ISO standards, reference materials, training resources, and global expertise networks, all made freely available to accelerate their inner source program development ## 📰 Newsletter The OpenChain Project offers a compelling perspective for WordPress inner source initiatives: the processes needed to manage internal code sharing mirror those required for external open source participation. After nine years developing ISO standards for supply chain trust, OpenChain has created freely available resources that WordPress teams can adapt immediately. Their key insight applies directly to WordPress development: whether you're contributing to Core, sharing code between teams, or managing plugins internally, you're facing the same fundamental process challenges. Large organizations like Automattic or hosting companies already operate internal supply chains where teams pass code between units. OpenChain's CC0-licensed materials include maturity modeling, training curricula, and process frameworks covering everything from traditional license compliance to emerging AI governance. Their global community includes ambassadors who can provide direct connections to expertise and ongoing work groups tackling current challenges like SBOM quality standards. For WordPress professionals, this represents an opportunity to leverage proven frameworks rather than building governance from scratch. The project's prediction that inner source will follow open source's trajectory toward standardization suggests early adoption of these resources could provide competitive advantages. Resources: [OpenChain Project](https://openchainproject.org), [Learn WordPress](https://learn.wordpress.org/), [WordPress Core Handbook](https://make.wordpress.org/core/handbook/) ## ✅ Action Items #### OSPO - Policy & Governance: Evaluate OpenChain ISO standards for internal code sharing policies - License Compliance: Download OpenChain reference materials for compliance training programs - Security Management: Review AI system bill of materials guidance for emerging tech governance - Developer Support: Adapt OpenChain training materials for internal developer education - Community Engagement: Connect with OpenChain ambassadors for expertise sharing - Strategic Alignment: Use OpenChain maturity modeling for OSPO development assessment #### Community - Maintainers: Apply OpenChain process frameworks to project governance templates - Contributors: Use standardized onboarding processes derived from OpenChain materials - Sponsors: Implement transparent governance using proven open source management practices #### WordPress - Core: Adopt process management standards for contribution workflows and release management - Community: Develop WordPress-specific adaptations of OpenChain training materials - Documentation: Create governance guides using OpenChain process frameworks - Meta: Implement supply chain trust standards for .org infrastructure ## 🧪 Hypotheses - Organizations implementing OpenChain-derived process standards will demonstrate measurably improved code governance outcomes compared to ad-hoc approaches - Inner source programs following open source process management patterns will achieve faster time-to-value than those developing custom governance frameworks - Companies that adopt standardized process frameworks early will experience fewer compliance issues as regulation increases - Cross-organizational collaboration on process standards reduces individual organizational governance development costs ### 📊 Methodology - Comparative study tracking governance maturity scores before and after OpenChain framework adoption - Longitudinal analysis of inner source program success metrics across different governance approaches - Cost-benefit analysis comparing custom governance development versus standards adoption - Survey research on compliance preparedness across organizations with different process maturity levels ### ❓ Questions - How can WordPress-specific governance challenges be addressed through OpenChain process adaptations? - What metrics best demonstrate the ROI of standardized process management in inner source contexts? - How do regulatory compliance requirements vary across different organizational contexts and geographies? ### 🔮 Future Research - Development of WordPress ecosystem-specific process management standards building on OpenChain foundations - Investigation of AI governance needs specific to content management and publishing platforms - Analysis of supply chain trust requirements for WordPress hosting and service providers ### 💡 Implications - Practice: Organizations can accelerate governance development by adapting proven standards rather than building from scratch - Policy: International standards provide frameworks for developing compliant internal code sharing policies - Security: Process standardization improves security posture by ensuring consistent governance across teams - Education: Freely available training materials reduce barriers to governance capability development - Funding: Standards adoption may reduce governance development costs while improving compliance outcomes ### 🧠 Learning Styles Assessment Reading level estimate: Flesch-Kincaid Grade Level 12 #### 👀 Visual learners - Present: Supply chain diagrams, organizational charts showing internal/external parallels - Improve: Process flow diagrams, governance maturity visualizations, standards comparison charts #### 🔊 Aural learners - Present: Conference presentation format with speaker explanations - Improve: Podcast-style summary, recorded standards walkthroughs #### 🗣️ Verbal learners - Present: Clear definitions of process management, governance terminology - Improve: Glossary of standards language, analogy-driven explanations #### 🧩 Kinesthetic learners - Present: Reference to downloadable materials and hands-on community participation - Improve: Step-by-step implementation guides, governance assessment checklists #### 🧠 Logical learners - Present: Clear cause-and-effect relationships, structured argument progression - Improve: Decision trees for standards adoption, quantified benefits analysis #### 🧑‍🤝‍🧑 Social learners - Present: Strong emphasis on community collaboration and ambassador networks - Improve: Structured community onboarding guides, peer review processes #### 🧘‍♀️ Solitary learners - Present: Self-directed access to reference materials and standards - Improve: Self-assessment tools, individual learning paths through materials #### 🌿 Naturalistic learners - Present: Ecosystem thinking about supply chains and organizational interconnections - Improve: Sustainability implications of governance choices, lifecycle thinking ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, descriptive link text for QR code alternatives - Improve: Alt text for diagrams, structured data for standards references #### Keyboard navigation - Present: Standard presentation navigation - Improve: Skip links for long content sections, keyboard shortcuts for materials #### Contrast and readability - Present: Professional presentation format with readable slides - Improve: High contrast versions of materials, font size options #### Text resizing and reflow - Present: Responsive presentation materials - Improve: Reflowable document versions, zoom-friendly layouts #### Media and captions - Present: Video presentation with transcript - Improve: Professional captions, audio descriptions for visual elements #### Forms and interactions - Present: Simple QR code interactions for resource access - Improve: Alternative text-based access methods, accessible download interfaces ### 🌍 DEIB Assessment #### Cultural breadth - Present: Global community representation across Japan, China, Korea, Europe, North America - Improve: Specific examples from underrepresented regions, translation priorities #### Inclusive --- ## Full Transcript [00:05] Hello everyone. It's a genuine pleasure [00:08] to be here. Uh the first thing I must do [00:11] is to to thank our organizers. [00:14] It's always incredibly difficult to hold [00:18] a conference and to hold a conference [00:20] across three continents is quite [00:24] something indeed. So, um, I think it's [00:26] it's worth giving an extra hand of [00:28] applause to Yuki and the rest of the [00:31] Inner Source Commons team for everything [00:32] they've done [00:35] and will do for the next 24 hours or so, [00:39] right? Um, a lot of you in this room are [00:43] familiar with the Open Chain Project, [00:45] but not all of you. So I'll give a brief [00:48] overview of open chain and then I'll [00:50] talk about how and why the type of [00:54] process management the type of [00:56] governance that we use in opensource is [00:59] directly relevant to inner source and [01:02] what's coming next. Uh this is a very [01:05] interesting time for our industry. We [01:08] have a lot of challenges for inner [01:10] source program offices and open-source [01:13] program offices. Many people have moved [01:16] on due to budget cuts and many companies [01:19] are asking very challenging questions [01:22] about why does what we do have value. [01:27] This talk will explain one perspective. [01:31] So I'm with the open chain project and [01:34] it has a very simple vision and mission. [01:36] Uh we want a more trusted supply chain. [01:39] So, we want to make that supply chain [01:41] more trusted and we're doing things to [01:44] make it happen. It's a big goal and it's [01:48] it's one we've been working on for nine [01:50] years. [01:52] We do various things, but we're best [01:54] known, I suppose, for our ISO standards. [01:58] These are process management standards [02:00] for open-source license compliance and [02:02] security assurance. We build out guides [02:05] and reference material and as mentioned [02:09] just before I took the stage we have a [02:11] very large community. So for instance in [02:14] Japan we have about 200 participants in [02:17] China about 360 participants. In Korea a [02:21] little over 200. We have participants in [02:25] Germany in North America. in the United [02:27] Kingdom. [02:29] In other words, lots of people working [02:31] together on the more trusted supply [02:33] chain. [02:35] The governing board of Open Chain is [02:37] substantial and represents trillions of [02:40] US dollars in market value, but the [02:42] governing board itself is only one small [02:46] part of the community. By the way, [02:48] you'll find various governing board [02:50] members in this room like Katosan from [02:52] Panasonic who's right there and [02:54] Kobayashi who's lurking at the back over [02:57] there from Toshiba. Uh these are people [03:01] who've contributed to building a [03:03] community and supporting the development [03:05] of things like ISO standards. [03:08] Now we cross all types of industry [03:11] verticals with what we do. We're not [03:13] focused on any specific area. So whether [03:17] people are doing consumer electronics or [03:19] they're building nuclear power plants, [03:22] we're part of what they do. If they [03:24] touch software, then we assist with [03:27] various process things. [03:31] The types of companies in our community [03:34] and these are contributors. For [03:35] instance, Loheed Martin is currently the [03:38] elected chair of our specification [03:40] development. They're not on our board. [03:42] They're an elected community member. All [03:45] of these different companies have people [03:47] doing various things and turning up on [03:49] various calls. Very open-source way of [03:52] doing things. [03:54] The question for us in this room is, is [03:57] there actually a genuine intersection [03:59] between open source and inner source [04:02] which leads you to have any reason to [04:05] care about what open chain is doing on [04:07] standards and reference material and our [04:10] community? Or is it different? And it's [04:13] true that inner source and open-source [04:16] are not identical. There are slightly [04:18] different priorities at times. One tends [04:21] to be about third-party IP and one tends [04:25] to be about internal IP. But if you pull [04:28] it together, they're very very similar [04:31] questions. O'Reilly, fellow Irishman, [04:35] was right uh when he associated inner [04:38] source with open source in the [04:40] beginning. [04:42] The question is how do you break down [04:44] those silos as the speaker before [04:46] mentioned how do you break down silos [04:49] internal or external to get more [04:51] innovation done and that is a shared [04:54] goal of us all [04:56] so with that shared challenge how do we [04:59] address it and I can tell you from our [05:01] perspective whether it's inner source or [05:04] open source what we think in general so [05:07] the mental model of the supply chain is [05:09] that companies or units are interacting [05:12] and doing things in an organized manner. [05:15] The reality is that it's chaos and no [05:17] one knows what's going on at all. And [05:20] the interesting thing is that when you [05:22] zoom into organizations, you find little [05:25] silos in the organizations doing things [05:27] like sharing code. So the supply chain [05:30] is just lots and lots of parties sharing [05:33] code. And in a bigger company, let's [05:36] pick randomly because I pointed at [05:37] Katosan earlier. A big company like [05:40] Panasonic Group, you have many, many, [05:43] many legal entities. In a company like [05:46] Seammens, which is one of our board [05:48] members, you have teams passing binary [05:51] code to each other. Because it's such a [05:53] big place, you're passing essentially a [05:56] product internally. What did you just [05:58] pass? How did you pass it? What's going [06:00] on? The supply chain is internal and [06:03] external. It's actually the same thing [06:05] from our perspective when it comes to [06:07] risk management. When we look at the [06:09] legal consequences, especially in the [06:12] long term because stuff that starts [06:15] inside tends to go outside at some point [06:18] or other. You need the same things. So, [06:21] Open Chain works on trying to build [06:24] stuff that helps this work without you [06:27] having to sit down from first principles [06:30] and work it out. We study things, [06:32] brainstorm, we build reference material [06:35] and guides and sometimes we build [06:37] standards. Basically, everything is [06:39] education, training or process [06:42] management high level. So you'll find [06:45] things like SPDX defining bill of [06:48] materials or to-do group talking about [06:50] open-source program offices. So they're [06:53] going down the pyramid into [06:55] implementation. We stay up at the top [06:57] area focusing on the question of how do [07:00] you frame management of this field? What [07:05] processes do you need for inbound? What [07:08] processes do you need internally? And [07:11] what will you need if something is going [07:13] outbound? [07:14] So what we do is ask and answer the [07:17] questions directly related to things [07:19] that your lawyers and your executive [07:21] teams will ask you. [07:24] These are the two ISO standards we [07:26] maintain and um I have potentially [07:29] usefully put up QR codes in case you're [07:31] not familiar with them. Our ISO [07:33] standards are freely available. So you [07:35] can buy them off the ISO web store. You [07:38] can download them from another section [07:39] of the ISO website or you can just go to [07:42] our website and get them there. They [07:46] cover inbound, internal, outbound. These [07:49] are about process points. They're not [07:52] prescriptive. They don't tell you how to [07:54] do your job. They do tell you where [07:56] something needs to be done. And at the [07:59] very least, you may be interested to [08:01] check out the internal processes we've [08:03] identified because those will be [08:05] immediately applicable to your inner [08:07] source program offices. [08:10] So, our standards are the international [08:12] baseline for open-source license [08:15] management and open-source security [08:17] assurance. But in truth, no matter what [08:20] license management you're doing or what [08:22] security assurance you're doing, these [08:25] process points are important and [08:27] therefore potentially useful. Now, Inner [08:31] Source Commons has done remarkable work [08:34] in the last few years in building up a [08:37] great community and uh we've done okay [08:40] as well, I think, and we'd like to share [08:42] our community with you. We have all [08:44] types of work groups examining problems [08:47] or making outputs and it's happening [08:50] right now. So for example and I'll talk [08:52] about this later. We're doing a lot of [08:54] work around esbomb quality at the [08:57] moment. Uh there's a lot of regulation [08:59] coming in about sbombs. There's various [09:01] formats, but the question is what is it [09:04] I need exactly off my suppliers or off [09:07] my teams so that I'm meeting the [09:10] requirements of the European Union CRA [09:12] or I'm meeting the US government [09:14] requirements. Good news in this room. [09:17] Someone has solved it. Kobotaan from [09:19] Sony. I'm I'm joking. He's solved it [09:21] with everyone else. And there have got a [09:24] crossindustry sbomb quality guide. It's [09:27] coming out in December and there'll be a [09:29] public comment period, but naturally [09:31] it's always available already on our [09:34] website and you can download what we're [09:36] doing. You can join our calls. You can [09:38] be part of it. That type of stuff is [09:41] applicable to what you do as well. Like [09:44] I said, what starts internally tends to [09:47] go external. And even if you plan to [09:49] keep it forever inside, you'll still be [09:52] passing it between teams who need to [09:54] know what's here. [09:56] Now, we have ambassadors all around the [09:59] world as well as our board members and [10:01] our community chairs, people we've [10:03] appointed or volunteered to, I suppose, [10:07] lend a hand. And many of these faces are [10:10] also people who help out in areas like [10:13] inner source program offices. Many of [10:15] them are in the room. For instance, I'm [10:17] going to pick a Wadisan here. Where's [10:18] Aadisan gone? There you are. He secretly [10:22] does a lot of the hard work for our [10:23] Japan community. So for instance when we [10:26] edit our videos that's him. Our [10:28] ambassadors are available to give a [10:31] friendly chat and are a great resource [10:33] which can hopefully help you too. More [10:36] formally our work groups and study [10:38] groups have their chairs who act as a [10:41] nexus point. So if you had a question [10:43] about in China what's incoming on policy [10:47] around open source you can talk to Zenoa [10:50] from bite dance who will be able to [10:52] connect you directly with every party [10:55] you need to talk with including the [10:57] party. [11:00] Now when it comes to open chain we do [11:03] try to produce reference material and I [11:06] wanted to say one thing please plunder [11:08] it. We release it under CC0 so you can [11:11] take it and do whatever you want with [11:13] it. So for instance our reference [11:15] training slides focused on open-source [11:18] license compliance training you can take [11:21] that and remix it in any way you want. [11:24] maturity modeling. I think we might have [11:26] been the first to go and release [11:28] corporate maturity modeling under CC0 [11:31] licensing focused on open innovation. [11:35] So, you know, in the past, you'd have to [11:37] develop it internally or pay an [11:39] organization like Deote or PWC for [11:42] maturity modeling. Now, you can download [11:44] and remix it from our website. [11:47] We have over 1,500 reference documents [11:51] in 14 languages in our library and you [11:55] can take whatever you want from there [11:58] and do whatever you want with it. We [12:00] would love if as you pass through you [12:03] helped us with a translation or two. Uh [12:05] that would be very convenient and we [12:07] always welcome more information. [12:09] We don't have enough about inner source. [12:12] So an ask I have for this room is if you [12:15] could spend a moment to potentially give [12:18] us information about problems in inner [12:21] source we can integrate with answers in [12:24] our library be very useful. We've [12:27] released over a hundred webinars in the [12:29] last five years covering everything [12:32] including I think inner source three [12:34] times now. Uh we try to have an [12:37] educational program that allows people [12:40] to find experts, see them talk, hear [12:43] them answer questions, and of course [12:47] easily follow up by approaching us and [12:49] getting connected directly. [12:52] Now, evolution and practice, the final [12:54] part of what I'm going to talk about, [12:57] everything is always changing. And I [12:58] noticed Yuki talked a lot about AI. [13:01] We've been thinking about AI, too. We've [13:03] been slightly worried that everyone is [13:05] saying everything is AI and putting [13:07] random stuff in everything right now. Uh [13:10] the question is what did my supplier [13:12] just do? And we've been trying to answer [13:15] that. We have an artificial intelligence [13:17] system bill of materials compliance [13:19] guide which is a complex way of saying [13:22] we've identified the process points you [13:24] need to ask your teams and your [13:27] suppliers what did you do and then to [13:30] doublech checkck it against your policy [13:32] and make sure that your AI toothbrush or [13:34] whatever is not going to be infringing [13:37] on third party intellectual property and [13:39] it's not going to be exposing internal [13:42] stuff it shouldn't be exposing that came [13:44] out last month. We worked on it for 18 [13:47] months. We've made it so it links up [13:49] with ISO standards covering AI [13:52] management. It links up with system bill [13:54] of materials that other people have done [13:57] and it links up with our pre-existing [13:59] license compliance work. In other words, [14:02] if there's AI on the table, it fits in [14:04] neatly into pre-existing infrastructure. [14:07] It doesn't reinvent the wheel. ESBOM [14:10] quality, I mentioned it's available. We [14:13] will release it in December, but at this [14:15] QR code, you can access what we're doing [14:18] right now. Maybe most importantly, you [14:20] can also share your ideas about what [14:22] we're doing right now. Um, I've noticed [14:25] that Kobota tends to answer emails at [14:28] 1000 p.m., 11 p.m., and we're on calls [14:30] at midnight. So, he's happy to work all [14:33] the time to make sure that your comments [14:35] are included before our December [14:37] release. [14:38] You're welcome. [14:42] In conclusion, [14:44] uh the the whole market of open [14:45] innovation is actually becoming very [14:49] boring in a good way. It's getting [14:52] closer to traditional software asset [14:54] management. We don't have to make things [14:57] up anymore. We literally have ISO [14:59] standards. Where we don't have ISO [15:01] standards, we tend to have guides. We [15:04] have training material, maturity [15:06] modeling, all types of things. [15:09] Now I've been talking with various [15:11] people in inner source like for instance [15:13] Daniel about the future of inner source [15:15] and it does seem that it's following a [15:18] very similar trajectory [15:21] and I think the most important thing I [15:24] can say is that 99% certainty you'll be [15:28] going in the same direction as open [15:30] source management and 98% of what we've [15:34] done is exactly what you will end up [15:36] doing anyway and given that we've [15:38] released it freely, you may as well take [15:40] it. [15:42] Now, Open Chain has been powered by this [15:45] incredible community. I mean, what we've [15:47] ended up doing is spending tens of [15:50] thousands of hours of corporate time and [15:53] personal time. I wasn't joking about [15:55] Kabota and 10 p.m. We've spent so much [15:59] time working on this and building it uh [16:02] because we're passionate about it. You [16:04] know, this is our community meeting in [16:06] this room recently. [16:09] People love the fact that we can work [16:12] with the professionals that are doing [16:14] the same things as us, work with people [16:16] who genuinely care about innovation. [16:19] And working in openness is something [16:21] truly special. It's amazing to have [16:24] companies like Mitsubishi Electric [16:26] innovating internally. And they do. They [16:29] make incredible technology. But it's [16:31] even more amazing to have their people [16:33] come and meet others and share openly [16:37] about the problems they've solved. [16:40] I think there's no difference at all [16:42] between inner source and open source [16:44] when it comes to community. And I think [16:46] that the most positive thing we can do [16:49] is work together more often and get to [16:52] know each other even better. So open [16:55] chain everyone is always welcome. I see [16:58] smiling faces. this gentleman who's [17:00] obviously part of our beer study group. [17:06] We have an onsense study group as well. [17:08] That's Kobota in his spare time. Uh the [17:10] onsense study group's next meeting will [17:13] be in early December, I think. Yep. And [17:16] uh in Korea, there's a macro study [17:18] group. So we we have all types of social [17:21] things going on and we're genuine [17:23] friends as well as colleagues. I'd love [17:26] to invite you to participate in what we [17:28] do. uh because we want to learn from you [17:31] as individuals and as experts in your [17:33] domain. So I do hope that you'll drop by [17:37] open chain uh because what we do is so [17:40] interconnected with what you do. We're [17:43] trying to learn as much as possible [17:45] about inner source and to see where we [17:48] can help but also to see where we can [17:50] learn and educate ourselves and adjust [17:52] our material and our approach. [17:56] Open innovation. Uh this is my 19th year [18:00] working directly in opensource. [18:04] So I've seen a lot of the cycles. I'm [18:06] one of the original group of the hackery [18:09] types like Harold Velte and all of that [18:12] who worked on this in the early days. [18:15] We've seen a lot of evolution. Uh we've [18:18] seen a lot of corporate stuff happening. [18:22] What we haven't seen is any difference [18:24] in the fundamental which is that we [18:27] discovered working together works better [18:30] and working together between [18:32] organizations working together inside an [18:35] organization it's all the same thing. [18:39] We're very lucky to participate in this [18:41] community. I certainly don't regret the [18:43] 19 years I've spent here and I do think [18:47] there's a lot more to be done. [18:50] Final note, we have a huge [18:52] responsibility to the next generation. [18:55] Right now, young people are saturated [18:57] with technology, but so many people are [19:00] touched by technology that most of them [19:04] have very little knowledge of how we [19:06] make it or that it can be adjusted, it [19:08] can be changed. People have become more [19:11] passive consumers because of scale. when [19:14] you're touching five billion people only [19:17] a very small subset know how things work [19:20] that's you I think we've got a bit of a [19:23] responsibility to keep building and [19:25] expanding our community and helping [19:27] people come in and join us so I do hope [19:31] you'll be part of open chain and I hope [19:33] that open chain will more and more be [19:35] part of inner source and with that I [19:37] thank you very Much.  ## 📺 Video ![](https://www.youtube.com/watch?v=bfjL9bd5JE8) --- # 📝 Full Notes (Deep-Read Analysis) # 🏷️ Title: Understand Why Open Source Process Management Matters To InnerSource ## 🧰 Action Inbox - [H1] Explore OpenChain ISO standards for process management — free download available #process-management - [H2] Review OpenChain reference materials for inner source adaptation — CC0 licensed #resources - [H3] Connect with OpenChain community for collaboration — global ambassadors available #community ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [OpenChain Project](https://openchainproject.org) - [InnerSource Commons](https://innersourcecommons.org) ## 📝 Summary - Shane Coughlan from OpenChain argues that open source and inner source face fundamentally similar process management challenges - OpenChain has developed ISO standards for license compliance and security assurance that apply to both external and internal code sharing - The supply chain model reveals that internal organizational silos sharing code mirror external supply chain dynamics - Companies face identical risks and legal consequences whether code starts internally or externally, as internal code often becomes external - OpenChain offers freely available standards, reference materials, training, and community resources that inner source teams can leverage ## 📖 Main Content The OpenChain Project has spent nine years building process management standards for open source license compliance and security assurance, resulting in ISO standards that govern how organizations handle code in supply chains. Coughlan argues that the traditional distinction between inner source (internal IP) and open source (third-party IP) creates artificial boundaries when the underlying process challenges are identical. The core insight centers on supply chain dynamics: large organizations like Panasonic or Siemens have multiple legal entities and teams passing code between units, creating internal supply chains that mirror external ones. When teams share binary code internally, they face the same fundamental questions: What was passed? How was it passed? What are the compliance requirements? OpenChain addresses these challenges through process management rather than prescriptive solutions, focusing on identifying where processes need to exist rather than dictating specific implementations. Their ISO standards cover inbound, internal, and outbound processes, with internal processes being immediately applicable to inner source program offices. The project has created over 1,500 reference documents in 14 languages, all released under CC0 licensing for unrestricted use and modification. This includes maturity modeling, training materials, and guides covering emerging areas like AI system bill of materials and SBOM quality standards. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/bfjL9bd5JE8?t=0) — [H1] OpenChain Project Overview - Key idea: OpenChain works toward a more trusted supply chain through ISO standards - Evidence: "We want a more trusted supply chain... we're best known for our ISO standards" #### ⏱️ [02:15](https://youtu.be/bfjL9bd5JE8?t=135) — [H2] Community Scale and Industry Coverage - Key idea: OpenChain has massive global participation across all industry verticals - Evidence: "In Japan we have about 200 participants, in China about 360 participants" #### ⏱️ [03:45](https://youtu.be/bfjL9bd5JE8?t=225) — [H2] Industry Diversity in Community - Key idea: OpenChain crosses all industry verticals from consumer electronics to nuclear power - Evidence: "Whether people are doing consumer electronics or building nuclear power plants, we're part of what they do" #### ⏱️ [05:30](https://youtu.be/bfjL9bd5JE8?t=330) — [H1] Core Argument: Inner Source and Open Source Similarity - Key idea: Inner source and open source address very similar challenges despite different IP focuses - Evidence: "They're very very similar questions... shared goal of breaking down silos" #### ⏱️ [07:00](https://youtu.be/bfjL9bd5JE8?t=420) — [H1] Supply Chain Mental Model - Key idea: The reality of supply chains is chaos with lots of parties sharing code - Evidence: "Mental model... companies are interacting in organized manner. Reality is chaos and no one knows what's going on" #### ⏱️ [08:15](https://youtu.be/bfjL9bd5JE8?t=495) — [H1] Internal vs External Supply Chain Equivalence - Key idea: Internal organizational code sharing mirrors external supply chain dynamics - Evidence: "Supply chain is internal and external. It's actually the same thing from our perspective" #### ⏱️ [09:30](https://youtu.be/bfjL9bd5JE8?t=570) — [H2] Process Management Focus - Key idea: OpenChain focuses on high-level process management rather than implementation details - Evidence: "We stay up at the top area focusing on how do you frame management of this field" #### ⏱️ [10:45](https://youtu.be/bfjL9bd5JE8?t=645) — [H2] ISO Standards Accessibility - Key idea: OpenChain ISO standards are freely available through multiple channels - Evidence: "You can buy them off ISO web store... or just go to our website and get them there" #### ⏱️ [12:00](https://youtu.be/bfjL9bd5JE8?t=720) — [H2] Process Points Not Prescriptive - Key idea: Standards identify where processes need to exist rather than dictating how - Evidence: "They don't tell you how to do your job. They do tell you where something needs to be done" #### ⏱️ [13:30](https://youtu.be/bfjL9bd5JE8?t=810) — [H2] SBOM Quality Work Group Example - Key idea: OpenChain actively develops cross-industry guides for emerging challenges - Evidence: "Cross-industry SBOM quality guide... coming out in December" #### ⏱️ [15:00](https://youtu.be/bfjL9bd5JE8?t=900) — [H2] Global Ambassador Network - Key idea: OpenChain has ambassadors worldwide who can provide connections and expertise - Evidence: "Ambassadors all around the world... available to give friendly chat" #### ⏱️ [16:30](https://youtu.be/bfjL9bd5JE8?t=990) — [H1] CC0 Licensed Reference Materials - Key idea: All OpenChain reference materials are released for unrestricted use - Evidence: "We release it under CC0 so you can take it and do whatever you want" #### ⏱️ [18:00](https://youtu.be/bfjL9bd5JE8?t=1080) — [H2] Extensive Resource Library - Key idea: OpenChain maintains over 1,500 reference documents in 14 languages - Evidence: "Over 1,500 reference documents in 14 languages in our library" #### ⏱️ [20:15](https://youtu.be/bfjL9bd5JE8?t=1215) — [H2] AI System Bill of Materials - Key idea: OpenChain has developed guidance for AI-specific compliance challenges - Evidence: "Artificial intelligence system bill of materials compliance guide... worked on it for 18 months" #### ⏱️ [22:30](https://youtu.be/bfjL9bd5JE8?t=1350) — [H1] Market Evolution Toward Standardization - Key idea: Open innovation is becoming standardized like traditional software asset management - Evidence: "Getting closer to traditional software asset management. We literally have ISO standards" #### ⏱️ [24:00](https://youtu.be/bfjL9bd5JE8?t=1440) — [H1] Prediction: Inner Source Will Follow Open Source Path - Key idea: Inner source will follow the same trajectory as open source management - Evidence: "99% certainty you'll be going in same direction... 98% of what we've done is exactly what you will end up doing" #### ⏱️ [26:30](https://youtu.be/bfjL9bd5JE8?t=1590) — [H1] Community and Collaboration Values - Key idea: Working together between and within organizations represents the same fundamental principle - Evidence: "Working together works better... between organizations, inside an organization, it's all the same thing" ## 📚 References - [OpenChain Project Website](https://openchainproject.org) - [ISO Standards for Open Source License Compliance](https://www.iso.org/standard/81039.html) - [OpenChain Reference Materials](https://openchainproject.org/resources) - [InnerSource Commons](https://innersourcecommons.org) ## 🗣️ Paraphrase - OpenChain has developed internationally recognized process management standards for handling code in supply chains, addressing license compliance and security assurance through systematic approaches rather than prescriptive solutions - The fundamental challenges of managing code sharing are identical whether the code originates internally (inner source) or externally (open source), because internal code frequently becomes external and organizational silos mirror supply chain dynamics - Organizations can leverage OpenChain's nine years of community development, including ISO standards, reference materials, training resources, and global expertise networks, all made freely available to accelerate their inner source program development ## 📰 Newsletter The OpenChain Project offers a compelling perspective for WordPress inner source initiatives: the processes needed to manage internal code sharing mirror those required for external open source participation. After nine years developing ISO standards for supply chain trust, OpenChain has created freely available resources that WordPress teams can adapt immediately. Their key insight applies directly to WordPress development: whether you're contributing to Core, sharing code between teams, or managing plugins internally, you're facing the same fundamental process challenges. Large organizations like Automattic or hosting companies already operate internal supply chains where teams pass code between units. OpenChain's CC0-licensed materials include maturity modeling, training curricula, and process frameworks covering everything from traditional license compliance to emerging AI governance. Their global community includes ambassadors who can provide direct connections to expertise and ongoing work groups tackling current challenges like SBOM quality standards. For WordPress professionals, this represents an opportunity to leverage proven frameworks rather than building governance from scratch. The project's prediction that inner source will follow open source's trajectory toward standardization suggests early adoption of these resources could provide competitive advantages. Resources: [OpenChain Project](https://openchainproject.org), [Learn WordPress](https://learn.wordpress.org/), [WordPress Core Handbook](https://make.wordpress.org/core/handbook/) ## ✅ Action Items #### OSPO - Policy & Governance: Evaluate OpenChain ISO standards for internal code sharing policies - License Compliance: Download OpenChain reference materials for compliance training programs - Security Management: Review AI system bill of materials guidance for emerging tech governance - Developer Support: Adapt OpenChain training materials for internal developer education - Community Engagement: Connect with OpenChain ambassadors for expertise sharing - Strategic Alignment: Use OpenChain maturity modeling for OSPO development assessment #### Community - Maintainers: Apply OpenChain process frameworks to project governance templates - Contributors: Use standardized onboarding processes derived from OpenChain materials - Sponsors: Implement transparent governance using proven open source management practices #### WordPress - Core: Adopt process management standards for contribution workflows and release management - Community: Develop WordPress-specific adaptations of OpenChain training materials - Documentation: Create governance guides using OpenChain process frameworks - Meta: Implement supply chain trust standards for .org infrastructure ## 🧪 Hypotheses - Organizations implementing OpenChain-derived process standards will demonstrate measurably improved code governance outcomes compared to ad-hoc approaches - Inner source programs following open source process management patterns will achieve faster time-to-value than those developing custom governance frameworks - Companies that adopt standardized process frameworks early will experience fewer compliance issues as regulation increases - Cross-organizational collaboration on process standards reduces individual organizational governance development costs ### 📊 Methodology - Comparative study tracking governance maturity scores before and after OpenChain framework adoption - Longitudinal analysis of inner source program success metrics across different governance approaches - Cost-benefit analysis comparing custom governance development versus standards adoption - Survey research on compliance preparedness across organizations with different process maturity levels ### ❓ Questions - How can WordPress-specific governance challenges be addressed through OpenChain process adaptations? - What metrics best demonstrate the ROI of standardized process management in inner source contexts? - How do regulatory compliance requirements vary across different organizational contexts and geographies? ### 🔮 Future Research - Development of WordPress ecosystem-specific process management standards building on OpenChain foundations - Investigation of AI governance needs specific to content management and publishing platforms - Analysis of supply chain trust requirements for WordPress hosting and service providers ### 💡 Implications - Practice: Organizations can accelerate governance development by adapting proven standards rather than building from scratch - Policy: International standards provide frameworks for developing compliant internal code sharing policies - Security: Process standardization improves security posture by ensuring consistent governance across teams - Education: Freely available training materials reduce barriers to governance capability development - Funding: Standards adoption may reduce governance development costs while improving compliance outcomes ### 🧠 Learning Styles Assessment Reading level estimate: Flesch-Kincaid Grade Level 12 #### 👀 Visual learners - Present: Supply chain diagrams, organizational charts showing internal/external parallels - Improve: Process flow diagrams, governance maturity visualizations, standards comparison charts #### 🔊 Aural learners - Present: Conference presentation format with speaker explanations - Improve: Podcast-style summary, recorded standards walkthroughs #### 🗣️ Verbal learners - Present: Clear definitions of process management, governance terminology - Improve: Glossary of standards language, analogy-driven explanations #### 🧩 Kinesthetic learners - Present: Reference to downloadable materials and hands-on community participation - Improve: Step-by-step implementation guides, governance assessment checklists #### 🧠 Logical learners - Present: Clear cause-and-effect relationships, structured argument progression - Improve: Decision trees for standards adoption, quantified benefits analysis #### 🧑‍🤝‍🧑 Social learners - Present: Strong emphasis on community collaboration and ambassador networks - Improve: Structured community onboarding guides, peer review processes #### 🧘‍♀️ Solitary learners - Present: Self-directed access to reference materials and standards - Improve: Self-assessment tools, individual learning paths through materials #### 🌿 Naturalistic learners - Present: Ecosystem thinking about supply chains and organizational interconnections - Improve: Sustainability implications of governance choices, lifecycle thinking ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, descriptive link text for QR code alternatives - Improve: Alt text for diagrams, structured data for standards references #### Keyboard navigation - Present: Standard presentation navigation - Improve: Skip links for long content sections, keyboard shortcuts for materials #### Contrast and readability - Present: Professional presentation format with readable slides - Improve: High contrast versions of materials, font size options #### Text resizing and reflow - Present: Responsive presentation materials - Improve: Reflowable document versions, zoom-friendly layouts #### Media and captions - Present: Video presentation with transcript - Improve: Professional captions, audio descriptions for visual elements #### Forms and interactions - Present: Simple QR code interactions for resource access - Improve: Alternative text-based access methods, accessible download interfaces ### 🌍 DEIB Assessment #### Cultural breadth - Present: Global community representation across Japan, China, Korea, Europe, North America - Improve: Specific examples from underrepresented regions, translation priorities #### Inclusive --- # 📄 Full Transcript *Auto-generated from YouTube captions · timestamps roughly every 30 seconds · [watch on YouTube](https://www.youtube.com/watch?v=bfjL9bd5JE8)* **[00:05]** Hello everyone. It's a genuine pleasure to be here. Uh the first thing I must do is to to thank our organizers. It's always incredibly difficult to hold a conference and to hold a conference across three continents is quite something indeed. So, um, I think it's it's worth giving an extra hand of applause to Yuki and the rest of the Inner Source Commons team for everything they've done and will do for the next 24 hours or so, **[00:39]** right? Um, a lot of you in this room are familiar with the Open Chain Project, but not all of you. So I'll give a brief overview of open chain and then I'll talk about how and why the type of process management the type of governance that we use in opensource is directly relevant to inner source and what's coming next. Uh this is a very interesting time for our industry. We have a lot of challenges for inner **[01:10]** source program offices and open-source program offices. Many people have moved on due to budget cuts and many companies are asking very challenging questions about why does what we do have value. This talk will explain one perspective. So I'm with the open chain project and it has a very simple vision and mission. Uh we want a more trusted supply chain. So, we want to make that supply chain **[01:41]** more trusted and we're doing things to make it happen. It's a big goal and it's it's one we've been working on for nine years. We do various things, but we're best known, I suppose, for our ISO standards. These are process management standards for open-source license compliance and security assurance. We build out guides and reference material and as mentioned just before I took the stage we have a **[02:11]** very large community. So for instance in Japan we have about 200 participants in China about 360 participants. In Korea a little over 200. We have participants in Germany in North America. in the United Kingdom. In other words, lots of people working together on the more trusted supply chain. The governing board of Open Chain is substantial and represents trillions of US dollars in market value, but the **[02:42]** governing board itself is only one small part of the community. By the way, you'll find various governing board members in this room like Katosan from Panasonic who's right there and Kobayashi who's lurking at the back over there from Toshiba. Uh these are people who've contributed to building a community and supporting the development of things like ISO standards. Now we cross all types of industry verticals with what we do. We're not **[03:13]** focused on any specific area. So whether people are doing consumer electronics or they're building nuclear power plants, we're part of what they do. If they touch software, then we assist with various process things. The types of companies in our community and these are contributors. For instance, Loheed Martin is currently the elected chair of our specification development. They're not on our board. They're an elected community member. All **[03:45]** of these different companies have people doing various things and turning up on various calls. Very open-source way of doing things. The question for us in this room is, is there actually a genuine intersection between open source and inner source which leads you to have any reason to care about what open chain is doing on standards and reference material and our community? Or is it different? And it's true that inner source and open-source **[04:16]** are not identical. There are slightly different priorities at times. One tends to be about third-party IP and one tends to be about internal IP. But if you pull it together, they're very very similar questions. O'Reilly, fellow Irishman, was right uh when he associated inner source with open source in the beginning. The question is how do you break down those silos as the speaker before mentioned how do you break down silos **[04:49]** internal or external to get more innovation done and that is a shared goal of us all so with that shared challenge how do we address it and I can tell you from our perspective whether it's inner source or open source what we think in general so the mental model of the supply chain is that companies or units are interacting and doing things in an organized manner. The reality is that it's chaos and no one knows what's going on at all. And **[05:20]** the interesting thing is that when you zoom into organizations, you find little silos in the organizations doing things like sharing code. So the supply chain is just lots and lots of parties sharing code. And in a bigger company, let's pick randomly because I pointed at Katosan earlier. A big company like Panasonic Group, you have many, many, many legal entities. In a company like Seammens, which is one of our board members, you have teams passing binary **[05:51]** code to each other. Because it's such a big place, you're passing essentially a product internally. What did you just pass? How did you pass it? What's going on? The supply chain is internal and external. It's actually the same thing from our perspective when it comes to risk management. When we look at the legal consequences, especially in the long term because stuff that starts inside tends to go outside at some point or other. You need the same things. So, Open Chain works on trying to build **[06:24]** stuff that helps this work without you having to sit down from first principles and work it out. We study things, brainstorm, we build reference material and guides and sometimes we build standards. Basically, everything is education, training or process management high level. So you'll find things like SPDX defining bill of materials or to-do group talking about open-source program offices. So they're going down the pyramid into **[06:55]** implementation. We stay up at the top area focusing on the question of how do you frame management of this field? What processes do you need for inbound? What processes do you need internally? And what will you need if something is going outbound? So what we do is ask and answer the questions directly related to things that your lawyers and your executive teams will ask you. These are the two ISO standards we **[07:26]** maintain and um I have potentially usefully put up QR codes in case you're not familiar with them. Our ISO standards are freely available. So you can buy them off the ISO web store. You can download them from another section of the ISO website or you can just go to our website and get them there. They cover inbound, internal, outbound. These are about process points. They're not prescriptive. They don't tell you how to do your job. They do tell you where **[07:56]** something needs to be done. And at the very least, you may be interested to check out the internal processes we've identified because those will be immediately applicable to your inner source program offices. So, our standards are the international baseline for open-source license management and open-source security assurance. But in truth, no matter what license management you're doing or what security assurance you're doing, these process points are important and **[08:27]** therefore potentially useful. Now, Inner Source Commons has done remarkable work in the last few years in building up a great community and uh we've done okay as well, I think, and we'd like to share our community with you. We have all types of work groups examining problems or making outputs and it's happening right now. So for example and I'll talk about this later. We're doing a lot of work around esbomb quality at the moment. Uh there's a lot of regulation **[08:59]** coming in about sbombs. There's various formats, but the question is what is it I need exactly off my suppliers or off my teams so that I'm meeting the requirements of the European Union CRA or I'm meeting the US government requirements. Good news in this room. Someone has solved it. Kobotaan from Sony. I'm I'm joking. He's solved it with everyone else. And there have got a crossindustry sbomb quality guide. It's coming out in December and there'll be a public comment period, but naturally **[09:31]** it's always available already on our website and you can download what we're doing. You can join our calls. You can be part of it. That type of stuff is applicable to what you do as well. Like I said, what starts internally tends to go external. And even if you plan to keep it forever inside, you'll still be passing it between teams who need to know what's here. Now, we have ambassadors all around the world as well as our board members and our community chairs, people we've **[10:03]** appointed or volunteered to, I suppose, lend a hand. And many of these faces are also people who help out in areas like inner source program offices. Many of them are in the room. For instance, I'm going to pick a Wadisan here. Where's Aadisan gone? There you are. He secretly does a lot of the hard work for our Japan community. So for instance when we edit our videos that's him. Our ambassadors are available to give a friendly chat and are a great resource which can hopefully help you too. More **[10:36]** formally our work groups and study groups have their chairs who act as a nexus point. So if you had a question about in China what's incoming on policy around open source you can talk to Zenoa from bite dance who will be able to connect you directly with every party you need to talk with including the party. Now when it comes to open chain we do try to produce reference material and I **[11:06]** wanted to say one thing please plunder it. We release it under CC0 so you can take it and do whatever you want with it. So for instance our reference training slides focused on open-source license compliance training you can take that and remix it in any way you want. maturity modeling. I think we might have been the first to go and release corporate maturity modeling under CC0 licensing focused on open innovation. So, you know, in the past, you'd have to **[11:37]** develop it internally or pay an organization like Deote or PWC for maturity modeling. Now, you can download and remix it from our website. We have over 1,500 reference documents in 14 languages in our library and you can take whatever you want from there and do whatever you want with it. We would love if as you pass through you helped us with a translation or two. Uh that would be very convenient and we always welcome more information. **[12:09]** We don't have enough about inner source. So an ask I have for this room is if you could spend a moment to potentially give us information about problems in inner source we can integrate with answers in our library be very useful. We've released over a hundred webinars in the last five years covering everything including I think inner source three times now. Uh we try to have an educational program that allows people **[12:40]** to find experts, see them talk, hear them answer questions, and of course easily follow up by approaching us and getting connected directly. Now, evolution and practice, the final part of what I'm going to talk about, everything is always changing. And I noticed Yuki talked a lot about AI. We've been thinking about AI, too. We've been slightly worried that everyone is saying everything is AI and putting random stuff in everything right now. Uh **[13:10]** the question is what did my supplier just do? And we've been trying to answer that. We have an artificial intelligence system bill of materials compliance guide which is a complex way of saying we've identified the process points you need to ask your teams and your suppliers what did you do and then to doublech checkck it against your policy and make sure that your AI toothbrush or whatever is not going to be infringing on third party intellectual property and it's not going to be exposing internal **[13:42]** stuff it shouldn't be exposing that came out last month. We worked on it for 18 months. We've made it so it links up with ISO standards covering AI management. It links up with system bill of materials that other people have done and it links up with our pre-existing license compliance work. In other words, if there's AI on the table, it fits in neatly into pre-existing infrastructure. It doesn't reinvent the wheel. ESBOM quality, I mentioned it's available. We **[14:13]** will release it in December, but at this QR code, you can access what we're doing right now. Maybe most importantly, you can also share your ideas about what we're doing right now. Um, I've noticed that Kobota tends to answer emails at 1000 p.m., 11 p.m., and we're on calls at midnight. So, he's happy to work all the time to make sure that your comments are included before our December release. You're welcome. In conclusion, **[14:44]** uh the the whole market of open innovation is actually becoming very boring in a good way. It's getting closer to traditional software asset management. We don't have to make things up anymore. We literally have ISO standards. Where we don't have ISO standards, we tend to have guides. We have training material, maturity modeling, all types of things. Now I've been talking with various people in inner source like for instance Daniel about the future of inner source **[15:15]** and it does seem that it's following a very similar trajectory and I think the most important thing I can say is that 99% certainty you'll be going in the same direction as open source management and 98% of what we've done is exactly what you will end up doing anyway and given that we've released it freely, you may as well take it. Now, Open Chain has been powered by this incredible community. I mean, what we've **[15:47]** ended up doing is spending tens of thousands of hours of corporate time and personal time. I wasn't joking about Kabota and 10 p.m. We've spent so much time working on this and building it uh because we're passionate about it. You know, this is our community meeting in this room recently. People love the fact that we can work with the professionals that are doing the same things as us, work with people who genuinely care about innovation. **[16:19]** And working in openness is something truly special. It's amazing to have companies like Mitsubishi Electric innovating internally. And they do. They make incredible technology. But it's even more amazing to have their people come and meet others and share openly about the problems they've solved. I think there's no difference at all between inner source and open source when it comes to community. And I think that the most positive thing we can do **[16:49]** is work together more often and get to know each other even better. So open chain everyone is always welcome. I see smiling faces. this gentleman who's obviously part of our beer study group. We have an onsense study group as well. That's Kobota in his spare time. Uh the onsense study group's next meeting will be in early December, I think. Yep. And uh in Korea, there's a macro study group. So we we have all types of social **[17:21]** things going on and we're genuine friends as well as colleagues. I'd love to invite you to participate in what we do. uh because we want to learn from you as individuals and as experts in your domain. So I do hope that you'll drop by open chain uh because what we do is so interconnected with what you do. We're trying to learn as much as possible about inner source and to see where we can help but also to see where we can learn and educate ourselves and adjust **[17:52]** our material and our approach. Open innovation. Uh this is my 19th year working directly in opensource. So I've seen a lot of the cycles. I'm one of the original group of the hackery types like Harold Velte and all of that who worked on this in the early days. We've seen a lot of evolution. Uh we've seen a lot of corporate stuff happening. What we haven't seen is any difference **[18:24]** in the fundamental which is that we discovered working together works better and working together between organizations working together inside an organization it's all the same thing. We're very lucky to participate in this community. I certainly don't regret the 19 years I've spent here and I do think there's a lot more to be done. Final note, we have a huge responsibility to the next generation. **[18:55]** Right now, young people are saturated with technology, but so many people are touched by technology that most of them have very little knowledge of how we make it or that it can be adjusted, it can be changed. People have become more passive consumers because of scale. when you're touching five billion people only a very small subset know how things work that's you I think we've got a bit of a responsibility to keep building and **[19:25]** expanding our community and helping people come in and join us so I do hope you'll be part of open chain and I hope that open chain will more and more be part of inner source and with that I thank you very Much.