Update openchain-standards-model-provisions.0.5.md

shanecoughlan · shanecoughlan · commit dae1cea1e3a8 · 2023-07-28T02:01:09.000+09:00
Updated the key model provisions document based on the outcome of the Legal Work Group call of 2023-07-28.

Basically: Andrew's additions mark the close of the document excepting final review, and the risk grid format items move to the risk grid. The risk grid will be the next subject for our review once core document is published.
diff --git a/Adoption-Preparation/Model-Provisions/openchain-standards-model-provisions.0.5.md b/Adoption-Preparation/Model-Provisions/openchain-standards-model-provisions.0.5.md
@@ -124,161 +124,4 @@ Note: this document is to be interpreted consistently with the OpenChain Specifi
 
 #### 1.8.4.　[usual ongoing obligations as to awareness of breaches etc.]
 
-#### 1.8.5.　[usual indemnity wording]
-
-# Below is a Series of Optional Model Language Issues in Original Risk Grid Format:
-
-Each issue is formatted as follows:
-
-- Issue　
-- Commentary　
-- Who is best placed to bear risk?　
-- Best mechanism to tackle risk　
-- Sample Wording　
-- Supplier's Arguments　
-- Customer's Arguments　
-
-## Overarching Topics
-
-### Issue - Inclusion of OpenChain ISO/IEC 5230
-
-#### Commentary　
-
-None listed.
-
-#### Who is best placed to bear risk?　
-
-Supplier.
-
-#### Best mechanism to tackle risk　
-
-None listed.
-
-#### Sample Wording　
-
-The Supplier warrants that the [Software] [defined components of the Software] originate[s] from an OpenChain ISO/IEC 5230:2000 Conformant Program [or Programs] [, with the OpenChain ISO/IEC 5230:2000 Conformant Program being specified in the Supplier Information Pack]. 
-
-or
-
-The Supplier warrants that the [Software] [defined components of the Software] originate[s] from a Program [or Programs] adhering to aspects of an OpenChain ISO/IEC 5230:2000 Conformant Program as specified in the Supplier Information Pack].
-
-and
-
-[The Supplier does not warrant that use, modification or further distribution by the Customer of the Software constitutes a continuation of adherence to an OpenChain ISO/IEC 5230:2000 Conformant Program].
-
-#### Supplier's Arguments　
-
-The Supplier may argue that the inclusion of these requirements or the extent of the requirements included introduce a cost-burden that need to be offset.
-
-#### Customer's Arguments　
-
-The Customer is receiving a potential liability regarding third-party intellectual property along with the Software deliverable from the Supplier. As such, it is reasonable to request that the Supplier adheres to international standards related to the licensing of this third-party intellectual property.
-
-### Issue - Inclusion of OpenChain ISO/IEC DIS 18974
-
-#### Commentary　
-
-None listed.
-
-#### Who is best placed to bear risk?　
-
-Supplier.
-
-#### Best mechanism to tackle risk　
-
-None listed.
-
-#### Sample Wording
-
-The Supplier warrants that the [Software] [defined components of the Software] originate[s] from an OpenChain ISO/IEC DIS 18974 Conformant Program [or Programs] [, with the OpenChain ISO/IEC DIS 18974 Conformant Program being specified in the Supplier Information Pack]. 
-
-or
-
-The Supplier warrants that the [Software] [defined components of the Software] originate[s] from a Program [or Programs] adhering to aspects of an OpenChain ISO/IEC DIS 18974 Conformant Program as specified in the Supplier Information Pack].
-
-and
-
-[The Supplier does not warrant that use, modification or further distribution by the Customer of the Software constitutes a continuation of adherence to an OpenChain ISO/IEC DIS 18974 Conformant Program].　
-
-#### Supplier's Arguments　
-
-The Supplier may argue that the inclusion of these requirements or the extent of the requirements included introduce a cost-burden that need to be offset.
-
-#### Customer's Arguments　
-
-The Customer is receiving a potential liability regarding security along with the Software deliverable from the Supplier. As such, it is reasonable to request that the Supplier adheres to international standards related to the managing of security assurance related to the Software.
-
-### Issue - Determining if the OpenChain Conformant Program is self-certified or third-party certified
-
-#### Commentary　
-
-None listed.
-
-#### Who is best placed to bear risk?　
-
-Supplier
-
-#### Best mechanism to tackle risk　
-
-None listed.
-
-#### Sample Wording　
-
-The Supplier warrants that the OpenChain [ISO/IEC 5230:2000][ISO/IEC DIS 18974] Conformant Program [or Programs] referenced in the relevant [purchasing agreement[s]] [contract[s]] is self-certified as per the checklists or questionnaires provided by the OpenChain Project.
-
-or
-
-The Supplier warrants that the OpenChain [ISO/IEC 5230:2000][ISO/IEC DIS 18974] Conformant Program [or Programs] referenced in the relevant [purchasing agreement[s]] [contract[s]] is third-party certified by [registered] [licensed] third-party certified.
-
-and
-
-[The Supplier will produce documentation to verify that the OpenChain [ISO/IEC 5230:2000][ISO/IEC DIS 18974] Conformant Program [or Programs] has undergone the disclosed certification process.]
-
-#### Supplier's Arguments　
-
-None.
-
-#### Customer's Arguments　
-
-The Customer requires clarity regarding the type of certification that the Supplier has undergone to contextualize their risk. A Customer may regard third-party certification as preferable due to the inherent audit involved. Alternatively, a Customer may be satisfied that self-certification is sufficient given that OpenChain ISO/IEC 5230:2000 or ISO/IEC DIS 18974 both require the party with a conformant program to maintain documentation on how they accomplished their conformance.  
-
-### Issue - Risk that the Declaration is just pro-forma, how to verify?
-
-#### Commentary　
-
-None listed.
-
-#### Who is best placed to bear risk?　
-
-Supplier
-
-#### Best mechanism to tackle risk　
-
-Audit rights
-
-#### Sample Wording　
-
-Customer may request that an audit be carried out to verify compliance to ISO/IEC 5230:2000 by a Third party auditor (**"Audit"**) that shall be approved by Supplier and such approval shall not be unreasonably withheld.
-
-The Audit is subject to the following conditions:
-
-a. it must only concern Supplier's OpenChain-related material, processes, policies and other relevant Artefact as provided for by ISO/IEC 5230:2000 that are used to demonstrate compliance.
-a. the auditor shall undertake a formal non disclosure agreement if it was not bound to professional secrecy by operation of the law;
-a. it must be carried out no more than once a year;
-a. it must come with an adequate advance notice, in no case less than 5 business days, and may be carried out during normal working hours, without interrupting the continuity of Supplier's activities or causing Supplier excessive burden and inconvenience, and in compliance with Supplier's safety policies;
-a. Customer shall bear all expenses arising out of or in connection with Audits at Supplier's premises, unless such Audits reveal that Supplier is not acting in compliance ISO/IEC 5230:2000, in which case all expenses shall be borne by Supplier.  Customer may prepare an audit report summarizing the results and observations of the Audits (**"Audit Report"**);
-a. If at all possible, the Audit shall be documental, but the auditor may interview personnel of the Supplier to verify the level of compliance.
-
-Audit Reports are confidential information of Supplier and Customer undertakes not to disclose them to third parties, with the exception of its own consultants, including legal consultants and its own employees.
-
-Supplier can respond to a request to carry out an audit by handing over a recent Audit Report performed by a reputable third part; such handing over may carry reasonably confidentiality conditions. A recent Audit Report is a report that was formed no more than 10 months prior to the request to carry over the audit. Customer shall not unreasonably refuse to accept such Audit Report *in lieu* of a full audit, but can demand to carry over an audit on areas which have not been accurately described or which have not been covered by the Audit Report.
-
-[in case Supplier is self-certified] Supplier may retain the auditor for becoming third-party certified or to renew third-party certification, but any such request may not be made earlier than one calendar month after the Audit Report has been delivered.
-
-#### Supplier's Arguments　
-
-Cost and complication of an audit process, confidentiality.
-
-#### Customer's Arguments　
-
-Costs are borne mainly by Customer, confidentiality is tackled by NDA and the process is run by a third party, frequency is limited and the audit can be done by showing a reliable audit done by a reputable third party.
+#### 1.8.5.　[usual indemnity wording]
