Created FAQ Version 2

shanecoughlan · shanecoughlan · commit 760831262782 · 2022-10-07T05:28:39.000+02:00
diff --git a/FAQ/2.0/en/faq.md b/FAQ/2.0/en/faq.md
@@ -0,0 +1,197 @@
+# Frequently Asked Questions
+
+Version 2
+
+## General FAQ
+
+The OpenChain Project is global community of organizations collaborating to create trust in the open source supply chain.
+
+We do this through ISO/IEC 5230:2020, the International Standard for open source license compliance, and our Security Assurance Reference Specification. We also have education, training and certification resources freely available to all parties. 
+
+Most importantly, our community acts as a support network where knowledge is shared to reduce friction and increase efficiency across all aspects of open source process management.
+
+### Where Can I Find A Formal Description Of The OpenChain Project?
+
+The formal description and structure of the OpenChain Project is contained in the Project Charter. You can find this on GitHub.
+
+https://github.com/OpenChain-Project/Project-Charter-And-Agreements/tree/master/Project-Charter
+
+### What Does The OpenChain Project Cover?
+
+The OpenChain Project is focused on building trust in the open source supply chain. Our primary emphasis is on issues related to license, security and other types of compliance. We are working towards a world where open source is predictable, understandable and optimized for internal and external supply chains of any type.
+
+Our global community also works on topics like open source training, open source policy, open source program offices (OSPOs) and more. Everything we do is open to everyone, and it is all freely available.
+
+### Who Conforms To The OpenChain Standards?
+
+We maintain a list of organizations decide to publicly announce OpenChain Conformant Programs through our website. 
+
+https://www.openchainproject.org/community-of-conformance
+
+However, because our specifications are supply chain standards, they focus on the relationship between customers and suppliers, so most organizations adopt our work without public announcement.
+
+The primary way you find out if an organization is OpenChain ISO 5230 or OpenChain Security Assurance conformant is by discussing their conformance in procurement negotiations or through their sales material. You can also ask their OSPO (if present) about their conformance status.
+
+### How Is The OpenChain Project Organized?
+
+The OpenChain Project has global and local work groups that anyone can be part of. Some examples are the:
+
+Specification Work Group, which identifies and publishes a set of core requirements a quality open source compliance program should satisfy.
+
+Education Work Group, which provides reference material to help organization meet our specification requirements.
+
+You can find a full list of our work groups and other activities on our community page.
+
+https://www.openchainproject.org/community
+
+There are three committees for member companies:
+
+Governing Board – Manage policies or rules and procedures for the Project, fund raising, budgeting and so forth.
+
+Steering Committee – Development, management and updating of the OpenChain Compliance Specification.
+
+Outreach Committee – Designing, developing and executing efforts to build an OpenChain compliance ecosystem throughout relevant supply chains in collaboration with the Governing Board.
+
+### Can I Participate In The OpenChain Project?
+
+Yes, of course. Everyone from any company, organization or government is welcome to participate. We also welcome individuals interested in the topics we cover. There is no registration or membership required. Get started here:
+
+https://www.openchainproject.org/community
+
+### Can My Company Become An OpenChain Member?
+
+There is no membership requirement to attend our meetings, to join our calls and webinars, or to help edit our standard and reference material. There is currently one membership level for the OpenChain Project: Platinum Membership. This is available to user companies (not vendors) and it provides a seat and a vote on our governing board and our steering committee. To learn more contact the General Manager at scoughlan@linuxfoundation.org. 
+
+There is also a partner program for vendor companies to engage with OpenChain. You can learn more here:
+
+https://www.openchainproject.org/partners
+
+### How Is The OpenChain Project Related To Other Linux Foundation Process Projects?
+
+The OpenChain Project has various sister standards covering adjacent topics in the area of open source process management. For example, the SDPX Project maintains SPDX ISO/IEC 5962, the International Standard for Software Bill of Materials (SBOM). The Open Source Security Foundation (OpenSSF) has extensive investment in security-related practices and management. The TODO Group has a focus on Open Source Program Offices (OSPOs). The Automated Compliance Tooling Project (ACT Project) supports open source tooling for automation related to management and compliance topics.
+
+We work with all of these projects to help companies find the best solution for their market requirements. The OpenChain Project has perhaps the highest level optic - how to get started with key processes for open source management - and then you can use our sister projects to build out your processes and continually improve your approach.
+
+### How Are The OpenChain Standards Related To The OpenSSF Best Practices Badge?
+
+The OpenChain Project and the OpenSSF Best Practices Badge are both Linux Foundation initiatives to identify criteria around open source process quality. The OpenChain Project focuses on the software supply chain. In contrast, the OpenSSF Best Practices Badge focuses on well-run open source projects themselves. These are complimentary initiatives, and both can be used to optimize open source from upstream to deployment and support.
+
+## OpenChain ISO/IEC 5230:2020 FAQ
+
+This is the FAQ for the OpenChain ISO/IEC 5230:2020 specification. We recommend that all contributors to our specification development process take a while to review this section of our FAQ. 
+
+### We work based on four principles:
+
+- Build trust around the open source supply chain.
+- Remember that less is more:
+-- Define the key requirements of a quality compliance program
+-- Do this by solving real pain points in the supply chain
+- Keep our specifications limited to what and why (avoid the how and when)
+-- Embrace different implementations to solve challenges
+-- Avoid mandating specific process content
+- Be open to all to participate and contribute
+
+### What is the objective of OpenChain ISO/IEC 5230:2020?
+
+It is designed to identify the key requirements of a quality open source license compliance program. This means it provides a level of trust about what organizations are doing as they ingest, internally develop and distribute open source software. 
+
+### Where can I find the current version of OpenChain ISO/IEC 5230:2020?
+
+You can find it on the OpenChain Project Specification page:
+
+https://www.openchainproject.org/get-started/conformance
+
+### Does an open source program need to satisfy all the requirements of the specification to be considered OpenChain Conforming?
+
+Yes. OpenChain ISO/IEC 5230:2020 the key requirements of a quality open source license compliance program. To make sure there are no gaps that would lead to poor quality output, a program must satisfy all the OpenChain ISO/IEC 5230:2020 requirements to be considered conforming.
+
+### Can software package be OpenChain ISO/IEC 5230:2020 conformant?
+
+No. OpenChain ISO/IEC 5230:2020 defines a quality open source license compliance program. The program is conformant. The software packages go *through* the program and therefore benefit from it. The question to ask suppliers is whether the software they supply was prepared under an OpenChain conforming program.
+
+### Does all the software in an organization need to be covered by an OpenChain ISO/IEC 5230:2020 conformant program?
+
+No. Organizations are often made from different groups or departments with different programs and release procedures. One example is that engineering may be very different from professional services). An organization decides how much of the total entity to cover with its OpenChain ISO/IEC 5230:2020 conformant program. Many companies start with one part of one group covering one product, and build out from there.
+
+### Does the specification serve as a best practice guide?
+
+No. OpenChain ISO/IEC 5230:2020 defines a quality open source license compliance program. It focuses on the “what and why” aspects of a program and not the how or when. A best practices guide must explain how and when to ensure it supports implementation activities. We publish reference material like Playbooks covering these topics, but they are separate to OpenChain ISO/IEC 5230:2020 itself.
+
+### How was OpenChain ISO/IEC 5230:2020 developed?
+
+The OpenChain Project developed OpenChain ISO/IEC 5230:2020 via our specification mailing list and calls. The process was (and is) open to everyone. The initial draft of OpenChain ISO/IEC 5230:2020 (then called OpenChain 1.0) was created in the 2015-2016 period and released in late 2016. Since then the OpenChain Project has continually reviewed and maintained the standard in an open, collaborative manner that mirrors how open source software is created.
+
+### Does OpenChain ISO/IEC 5230:2020 describe how to comply with the most popular open source licenses?
+
+No. OpenChain ISO/IEC 5230:2020 defines a quality open source license compliance program. It is not designed to identify, breakdown and interpret individual open source licenses. Because open source licenses are legal documents, they will also vary in their interpretation and application across different legal jurisdictions. Local organizations like OSADL (Germany) have worked on license obligation lists relevant for their markets.
+
+### Does OpenChain ISO/IEC 5230:2020 provide legal guidance?
+
+No. The specification does not provide legal guidance because that can only come from a legal expert assigned to advise an organization. OpenChain ISO/IEC 5230:2020 does require an organization to designate a legal expert to do this as part of the conformance process. OpenChain ISO/IEC 5230:2020 also requires that a process exists to ensure the appropriate attention is given to license obligation analysis and and fulfillment.
+
+### Does OpenChain ISO/IEC 5230:2020 conformance guarantee license compliance?
+
+No, but it significantly increases the probability that license compliance will be achieved for software prepared under an OpenChain ISO/IEC 5230:2020 conformant program.
+
+### Do resources exist to assist my organization in achieving OpenChain ISO/IEC 5230:2020 conformance?
+
+Yes. You will find a substantial amount of resources, including self-certification checklists, on the OpenChain website:
+
+https://www.openchainproject.org
+
+### What license is OpenChain ISO/IEC 5230:2020 released under?
+
+The version we host on our website (currently called OpenChain 2.1) is licensed under the Creative Commons Attribution License 4.0 (CC-BY-4.0). A copy of the license can be obtained here: 
+
+https://creativecommons.org/licenses/by/4.0/legalcode
+
+### What is the difference between Conformance vs Compliance
+
+OpenChain ISO/IEC 5230:2020 does not use the term “compliance” when referring to meeting the requirements of the specification itself. This was a conscious decision to avoid confusion between “license compliance” and meeting the specification requirements. That is why we use the term “conformance” when talking about meeting the specification requirements.
+
+## OpenChain Self-Certification FAQ
+
+OpenChain ISO/IEC 5230:2020 and the OpenChain Security Assurance Specification are designed to build trust around open source as clear and impartial standards. The approach is “less is more” and focus on what and why rather than how and when. Resources around self-certification are equally focused. They help organizations quickly understand practical application of the standards.
+
+### What is the objective of OpenChain Self-Certification?
+
+OpenChain self-certification resources are designed to help an organization assess if it meets the requirements of the standard with simple questions or checklists. Organizations of any size use self-certification as a way of improving their compliance approach and advertising that fact to their supply chain.
+
+### What if I don’t agree with a submission made by another organization?
+
+Contact the OpenChain Project with the name of the organization you are concerned about and the reason you disagree with their submission. We will get back to you to discuss the matter further. It should be noted that disagreements about conformance are exceptionally rare (we did not encounter one directly yet), but it is important to have a way to make sure the market is using our standards in a fair and balanced manner. You will find our contact details at the link below:
+
+https://www.openchainproject.org/about
+
+### How do I get started?
+
+You can use our self-certification questionnaire or checklist. You can access the questionnaire at the following link:
+
+https://github.com/OpenChain-Project/Reference-Material/blob/master/Self-Certification/Questionnaire/ISO5230-2020/en/
+
+You can access the checklist at the following link:
+
+https://github.com/OpenChain-Project/Reference-Material/blob/master/Self-Certification/Checklist/ISO5230-2020/en/
+
+Once you complete the process, please let me know so that we can add you to our Community of Conformance on the OpenChain Project website. This is not mandatory but it provides an advantage to you (more of your peers know that you have the key requirements of a quality open source compliance program in place), and it provides an advantage to us because we have more insight into market adoption. You can let us know about your conformance by contacting us here:
+
+https://www.openchainproject.org/about
+
+By the way, we also have a legacy self-certification web app. This has been used as the primary way to record conformance progress online since 2017. However, it is depreciated as we transition to document formats more easily ingested into organizations for self-certification. It can be here: 
+
+https://certification.openchainproject.org/
+
+### If I use the web app, can I change my submission?
+
+You will see an unsubmit button at the bottom of the page after signing in to the Online Self-Certification site. Clicking this button will cancel your previous OpenChain Self-Certification submission. You can then re-submit the conformance check. The site is here:
+https://certification.openchainproject.org/
+
+### If I use the web app, what response time should I expect to a submittal request?
+
+If all information is correct, the submittal will automatically be approved by the system. Any omissions or incorrect answers will be reported by the user.
+
+### How do I report issues with the web app?
+
+Contact us here:
+
+https://www.openchainproject.org/about
