Who

Maikel Mardjan

Email-dateMember?

26-November Yes

Comment

Hi,
Respect for this Great work!

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)
Modified; No,
Yes, Yes, Yes.
Should>encouraged.

Some Review on: https://owasp.org/www-policy/operational/chapterstomake it better:
Section: Chapter Leadership(1) - "Chapter leaders are not required to be members" -> Chapter
leaders
MUST be members(2) - "Leaders should transition or rotate every 2-3 years" -> Every 3
years(maximum) with minimum of 2 years.
Section Inactive Chapters:(3) - "To reactivate a chapter, a minimum of 50% of the leadershipmust benew." -> Remove. I can image many situations where very good
chapterleaders were not able to meet the requirements for period. Please be
more gentle to (personal)circumstances of chapter leaders.
Section Privacy:(4) "chapter meetings are subject to the EU GDPR" -> All chapter
meetings
are subject to local rules and regulations that apply in a country. All
chapter meeting MUST comply to the OECD principles(http://oecdprivacy.org/). This means that the Collection Limitation
Principle applies for all activities where personal information ofparticipants is needed.
(5) Regarding use of external services (meetup.com / google / Slackandother malware-services):If possible all chapter meetings SHOULD use
aservice that respects users privacy.
Opheliar Chan

27-November Yes

Under section "Chapter Supporters and bartering arrangements", thetext says "Any contractual agreement, bartering arrangement, or
financial transaction must be registered and processed by theFoundation." Which is fine. I was wondering if you could also include
instructions there on what the procedure is to register such an
agreement with the foundation and what the processing looks
like/approx sla's and required lead time, etc.
That would be very helpful. Thank you.

Accepted

Notes

Who

Lisa Jones

Email-dateMember?

27-November Yes

Comment

If a leader needs to step down, they must send a resignation email to
the Foundation before new leaders can submit. or submit a ticket to
the New Chapter/Leader Request.
Student chapter leaders are entitled to additional benefits including
mentoring and access to scholarships as available. Mentoring andscholarships are currently offered to all members, not only student
chapter leaders. The Chapter Committee added this to the policy. I
will need information to answer questions when asked if this is toremain as part of the policy.
Each chapter is responsible for creating and maintaining their owasp.
org chapter home page. There needs to be clearly defined timeframes
for the creation of new chapter pages and updatings. Chasing 100+
chapters for the past 11 months should be proof of the need of aclearly defined policy. Also, if requests for new chapters are granted
chasing the leaders to create a page should have a deadline tocomplete.
Chapters shall host a minimum of 4 chapter activities a year tomaintain an active OWASP chapter. The activity can be in person,
virtual, or an approved OWASP event run by the OWASP chapter (orin collaboration with another chapter or external organization with theapproval of the Foundation.)
Local/Regional AppSec® Days events

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Accepted

Starting a student chapter
Students of high schools and institutions of higher education cancreate student chapters.
We do not set-up chapters for highschool students. These are minors
and involve risk, insurance and consent. We would need to consult
the lawyers before even considering.

Josh Sokol

1-December Yes

Hello,

Rejected

I had a comment on the new Chapters policy where it states "Eachchapter must have a minimum of 2 and a maximum of 5 leaders.".
I don’t think you should ever cap the number of leaders for a chapter.
I’m sure this is a financial decision based on OWASP now paying formemberships for leaders, but I could easily see larger chapters having
more than 5 leaders and don't think you should ever arbitrarily impose
limits on the amount of leadership a chapter can have. If it truly isbased on a financial concern, then maybe eliminate that maximum andsay that the Foundation will provide complimentary memberships for
up to 5 chapter leaders?
Lisa Jones

4-December Yes

Please, add that can only be a leader of ONE chapter.

Accepted

Harold Blankenship

8-December Yes

Remove the Leadership Benefits section as this belongs in the
Leaders policy

Accepted

Rick Mitchell

8-December Yes

Headings throughout the document should consistently use Title Caps.

AcceptedNathan Britton

13-December Yes

Leaders should transition or rotate every 2-3 years, and encourage
fresh Leaders to step up and participate in the Chapter operations.
With Smaller chapters this may prove difficult, my suggestion would be
to change this to 4 years and rather than “should” read “encourage”

Accepted

Notes

Who

Email-dateMember?

Comment

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)Nathan Britton

13-December Yes

Chapters shall host a minimum of 4 chapter activities a year tomaintain an active OWASP chapter.
The Covid pandemic has moved an inordinate amount of meetups tovirtual, to which i’m sure there is some “fatigue” over virtual meetups. I
appreciate the handbook has to work for a number of years, evenwhen Covid issues are reduced and in-person events can resume,
however, i’ve always thought with the work required 4 was tricky.
Again, especially for smaller chapters where the audience isn’t huge.
My suggestion is 3 activities and/or reword from “shall” to “aspire to”,
so as to decrease the pressure. I don’t see value in OWASP deactivating a Chapter because it only fulfils 2 or 3 activities per year.
Whilst this may not happen in practice and is more likely to happen if
no activities take place, i think the wording and the requirement should
be loosened.

Accepted - 3

Kyle Smith

14-December Yes

Chapter Leadership- Needs better definition of 'Leader' and 'leader'.. or at least clean-up
for capitalization needs to be done if there is no differentiation.
- for the minimum, might add 'must have a minimum of 2 (for expense
approvals) and a..' (and add a link to the policy/rational)- The timeline on returning the Leader's agreement is short, perhaps
30 days or a month is better.
- There is no timeline on the annual confirmation for continuing to be a
Leader. Needs definition.
- Why is the leadership change route different (submit a ticket) while
the step-down is both an email and a ticket?
- How does one sign-up to be a leader? Is this captured in the 'how tostart a new chapter' or Chapter Handbook or elsewhere?
- Need link to 'OWASP Foundation Shared Services' catalog.

Yes, No, 30d,
30d, modified,
accepted,
accepted

Kyle Smith

14-December Yes
Discoverability- services are discussed, but not referred to where to find out what
they are (needs catalog link)- how does a chapter leader create a chapter home page and populate
it with required information? (need link to how-to)- can chapter leaders put non- @owasp.org and non-commercial email
addresses on their chapter page?

Yes, Yes,
Modified encouraged touse owasp.org
email address

Kyle Smith

14-December Yes

Meetings and Activity Requirements- is there a lead time necessary to announce events to be qualified as
an activity?

Rejected

Kyle Smith

14-December Yes

Communication- what is the timeframe of 'monitor regularly' their @owasp.org email
address?
-- why 7 days for responses to Foundation requests? (does theFoundation have the same requirement on inquiries?)- where do chapter leaders set 'out-of-office' messages?
-- How do out-of-office that affect timelines on responding toFoundation requests and inactive chapters as detailed in the policy?

Modified, 7days to 9 days,
Otherwise leave
as current.

Kyle Smith

14-December Yes

Shared Services- are leaders automatically added to the leaders@owasp.org? Don't
they have to be defined explicitly on their Chapter's site as a leader
with the information?

n/a, automation- future work

Notes

Who

Email-dateMember?

Comment

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Kyle Smith

14-December Yes

Starting a New Chapter- "Prospective chapter leaders should familiarize themselves with thispolicy and the Chapter Handbook prior to submitting the form."
redundant and no link

Accepted

Kyle Smith

14-December Yes

Starting a student chapter- " For example, each educational institution in a city is more thanwelcome to have their own student chapter, which is not the case forregular city chapters" --- missing 'own'

Accepted

Kyle Smith

14-December Yes

Renaming a Chapter- missing link to 'Contact Us'

Accepted

Kyle Smith

14-December Yes

Regional chapters- 'Regional chapters hold no powers over any other chapter' in theaccepted region/geography - city and student chapters may be started
within an already defined region without approval or affiliation with anexisting regional chapter.
--- needs better definition if a city or student chapter in a region
already claimed can or can not be started

Accepted

Kyle Smith

14-December Yes

Inactive Chapters-- link back to policy section for activity requirements-- "To reactivate a chapter, a minimum of 50% of the leadership must
be new leadership." Otherwise it reads as 50% must be new people
and it could be argued that it can't come from the chapter.

Accepted
Modified through otherfeedback

Kyle Smith

14-December Yes

Finances, Oversight, and Transparency-- what operational basis does the Chapters Committee oversee? (oris this captured in the Chapters Committee charter?.. maybe need alink)-- "... that a Leader has not complied with this policy, leadership will be
revoked. .."Accepted

Kyle Smith

14-December Yes- Donations-- ".. and processed per the Foundation donations policy at the
OWASP Donations page." and provide link to the donations policy

Accepted

Kyle Smith

14-December Yes

Chapters are not legal entities.
- remove the ending '.'Accepted

Kyle Smith

14-December Yes

Finances are via OWASP Foundation only
- remove the ending '.'- need '-' in 'not-for-profit'

Accepted

Kyle Smith

14-December Yes

Chapters Supports and bartering arrangements- Where are these registered? (link)- What is out of scope for bartering arrangements?
-- Is there an evaluation process when they are registered? (is there apolicy?)Accepted

Kyle Smith

14-December Yes

Disputes- how to contact the Foundation? (need email or link)- 'Code of Conduct policy for ethical or conduct breaches'- '.. the Executive Director is the second point..'

Accepted

Notes

Who

Riotaro Okada

Email-dateMember?

15-December Yes

Comment

Chapter Leadership
It doesn’t make sense to make membership recommended but notrequired for chapter leaders. Chapter leaders need to consider the
benefits for both the OWASP community and OWASP Foundation
while fulfilling their responsibilities. It makes much more sense to
make membership required for chapter leaders, especially since thisrule and all activities chapter leaders engage in need to be alignedwith the overall policies of the OWASP Foundation.

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Modified change text toindicate 5
official leaders,
unofficiallyboardmembers, etcokay> • Each chapter must have a minimum of 2 and a maximum of 5
leaders.
The most appropriate number of leaders will depend on the chapter.
Some chapters won’t be able to find 2 leaders. Other chapters mightneed more than 5 leaders. There’s no need to use the word “must”
here. Rephrasing this as “should have a minimum of 2” would be
more appropriate.
When we started OWASP Japan, we used the London chapter as areference and started with 2 leaders and some people on the advisoryboard and management team. This gave us support from a wide
variety of different backgrounds and perspectives. There’s no need to
set the maximum number of chapter leaders at 5.
> • Leaders should transition or rotate every 2-3 years and encourage
fresh Leaders to step up and participate in the Chapter operations.
Leader selection is at the Chapter’s discretion.
Using “may” instead of “should” is more appropriate. Having at least 2
leaders allows for a balanced approach but having the leadershipchanged every couple of years will make it difficult to maintain astrong, consistent, and focused initiative for the chapter.
Riotaro Okada

15-December Yes

Leadership Benefits
If leaders are required to be members, as mentioned above, thisbenefit becomes unnecessary. An OWASP email address should
always be treated as an OWASP membership benefit and not be
granted to non-members.
The phrase “Chapter Committee” appears here for the first time, but it’s unclear what it means. There should be an explanation for this term.
> • Access to OWASP Foundation Shared Services
Access to OWASP Foundation Shared Services should be considered
as a chapter benefit and not a leadership benefit.
There’s no need to list any of the “leadership benefits” listed here.

Modified leadershipbenefits go in
Leadershippolicy

Notes

Who

Riotaro Okada

Email-dateMember?

Comment

Running a Chapter Discoverability
Saying that this is “not required” but making it essentially forced withthe rules is nonsense. Japanese people hardly use Meetup.com due
to localization and support for the Japanese market. The chapters inJapan have been using Doorkeeper, a local service. We already havethousands of OWASP community members registered on this service
and have been using it very smoothly and successfully.

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Modified remove Meetup.
com
Modified - may
not reimburse...

The small charge associated with using this service has been paid for
personally by the chapter leaders. This is an appropriate operational
expense. If the chapter leader requests and the chapter has thenecessary budget remaining, the policies should allow these expenses
to be reimbursed from the chapter budget.
Moreover, these types of operational guidelines should not be listed in
the policies. It’s more appropriate to list software/service selection,and other operational guidelines should be listed in the handbook.
> “If you use another platform, OWASP will not reimburse these
expenses.”
The individual chapter decides which service to use, and as such, theexpenses, in this case, should be paid for from the individual chapter
budget.
Riotaro Okada

Meetings and Activity Requirements> • Chapter activity information (date, time, and location) must be
posted on the owasp.org chapter page before the event start date.

-Reject-Accepted

Using “should” here instead of “must” is more appropriate. Posting
chapter activity information on owasp.org is definitely important, but
the current wording prevents posting information after the date. Also,in many cases, information is posted initially on SNS and event
registration platforms with more detailed information and activity
results posted on owasp.org after the date.
>The Chapter Handbook[TBD: Needs Link] contains details of how topublish event information automatically when using the OWASP
meeting scheduling platform.
The Chapter Handbook is not available yet, so this comment is notnecessary. If this reference material is related to this policy in general,then it should be included at the end.
Riotaro Okada

Starting a New Chapter
This would be a more realistic policy:"Create new chapter pages within ***30 days*** of GitHub access on
the owasp.org website.
Login into their owasp.org email account within ***7 days*** or they willneed to log a support ticket via Contact Us to have a password
recovery email sent to their registered email address."

Accepted

Notes

Who

Riotaro Okada

Email-dateMember?

Comment

Starting a city chapter

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Rejected

There’s no actual merit to using “must” in this clause. First of all, thedefinition of “city” is unclear. Does “city” refer to a politicaladministrative district, an economic spere, a cultural sphere? It’s
unclear what range we’re talking about, and this leads to confusion.
For reference, in Japan, there are 8 major regions, 47 prefectures, 20
ordinance-designated cities, within each of which there are around 10
to 20 wards and over 1700 municipalities throughout the country. Allof these could be referred to as “cities” in English. Saying that chapter
leaders “must” reside within 80 km (50 miles) doesn’t make any sense
since this distance might be inappropriate or unrealistic based on the
country or region.
As you know, with the effects of the pandemic this year, borderlesscommunication and collaborations between regions have increased.
Also, the current shift towards online meetings will probably continue
in the future. It’s not productive to have such strict policies on
geographical restrictions and the location of chapter leaders. The goal
should be to make it as easy for the right people to come together,regardless of geographical differences, and empower community
activities across a wide variety of regions.
Riotaro Okada

Renaming a Chapter
This should be changed to “Naming a Chapter.” I can understand thethinking behind using “cities” as a basis for naming chapters buthaving a strict policy like this makes no sense. The naming should be
looked at individually based on each team’s application to start achapter.
The meaning of having a chapter in a specific area can best be
understood by the local people there. The population of engineers
and benefits from collaborations between engineers of different areas
is different from region to region. The naming of a chapter can have ahuge impact on people's motivation to participate in chapter activities
actively.
For instance, in Japan, we have chapters such as OWASP KANSAI
and OWASP KYUSHU based on broader regional areas. Maybe thisapproach is similar to the OWASP Bay Area chapter. Within theseareas, multiple large cities historically have been competing against
each other. To ensure smoother collaboration between people living inthese regions, the local teams decided to form chapters based on theregions and not individual cities. This approach has been effective inattracting engineers from across the region and contributing to thesuccessful operations and activities of the chapter.

Modified Naming a
Chapter, otheritems covered
by upcoming
regional policy

Notes

Who

Riotaro Okada

Email-dateMember?

Comment

Regional chapters
Although the wording has improved from the initial draft, some of thewording still gives off a rude impression.
“Regional chapters have never been defined by any prior policy” is not
appropriate. Regional chapters were formed were to help areas that
could benefit from OWASP activities but had no one to encourage andfacilitate activities there.
Here in Japan, OWASP Japan has successfully helped start andfacilitate activities for many local chapters.
Being a non-English speaking country in the far east, Japan doesn’t
have a lot of people who can participate in the Global AppSec andcommunicate comfortably in English. Despite this, the Japanesetranslation team has actively worked on localizing OWASP documents
and collaborating with local companies and government agencies. As
a result, they’ve had some tremendous achievements, and Japan, acountry with one of the most if not the most access to owasp.org.
We’ve also successfully brought some Japanese companies such as
Rakuten, Panasonic, SCSK, Cybozu, and UBsecure onboard as
Corporate Sponsors, specifically because these companies were
motivated to support Japanese translation and localization activities
through the alignment with OWASP Japan. (A lot of these sponsors
were very disappointed when the alignment system was canceled.
Although I strongly object to the cancellation of the alignment system
for sponsorships, this is a separate topic)
Although the local chapter leaders in Japan have earnestly engaged inpushing forward local chapter activities, their difficulty communicating
in English makes it challenging for them to participate in these kinds ofpolicy reviews. OWASP Japan, over the years, has acted as a bridgewith local chapter leaders to help overcome these language barriersand ensure smoother communication.
Our approach has not gone against the “Regional chapters hold nopowers over any other chapters” wording in this policy, but thiswording is too direct and too strong considering the supportive andcollaborative activities of a regional chapter.
We should acknowledge that “Local chapter may respect that regional
chapters have supported local chapters directly or indirectly for many
years.” Including this type of comment would be better.
In the future as well, especially for non-English regions, co-organizing
AppSec Conference as we have held before in Tokyo, participation in
the chapter leader meeting (like Town Hall) as well as translation andlocalization activities would be more effective if done through regional
chapters, and are regional chapters are necessary for allowing a wide
variety of companies to be involved in sponsorship and community
collaborations.

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Rejected

Notes

Who

Email-dateMember?

Riotaro Okada

Comment

Current Text

Finances, Oversight, and Transparency

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Notes

Rejected> (including the leader’s owasp.org email address)
If the owasp.org email address is provided as a membership benefit
and not a leadership benefit, this policy is inappropriate. The email
address is also used for other community activities and collaborations,and leadership responsibilities, so revoking email rights immediately is
not an appropriate policy.
Daniel Ting

12/21/2020 Yes

Each chapter must havea minimum of 2 and amaximum of 5 leaders.

Each chapter must have a
Modifed - 3
minimum of 2 and amonthsmaximum of 5 leaders. In theevent of a recent resignation,
leadership transition, and/or
new leadership being
appointed, a chapter isallowed a grace period of up
to 6 months from the event tocomply.

Daniel Ting

12/21/2020 Yes

Any changes in chapter
leadership must be doneby submitting a ticketwith all information to
the New Chapter/Leader
Request by one of theexisting Leaders.

Modified Any changes in chapter
chapterleadership must be done bymanager
submitting a ticket with all(through JIRA)
information to the New
Chapter/Leader Request by
one of the existing Leaders.
However, if the local chapter
leadership is inactive, arequest by registered local
OWASP members can bemade to the OWASP Executive
Director to initiate the dispute
resolution process to submit achange of leadership on
behalf of the chapter.

Daniel Ting

12/21/2020 Yes

If a leader is no longer reasonably responsive, and proactively
contributing to the chapter, the remaining Chapter Leaders may
petition the chapter leader’s removal in accordance with the dispute
resolution process.

Accepted

Daniel Ting

12/21/2020 Yes

If a stepping down, Chapter Leader has gone above and beyond thecall of duty, and made significant contributions to the chapter andtowards OWASP’s mission over a number of years; the remaining
Chapter Leaders and the chapter membership, would like to recognisethat sacrifices and contributions made, it may confer the perpetual useof the title of “Emeritus Chapter Leader” for that chapter, and acomplimentary lifetime OWASP membership, which will be paid for bychapter funds.

Rejected

Daniel Ting

12/21/2020 Yes

Chapters shall retain on their Chapter page a running historical recordof previous chapter leadership and their terms, in recognition of theirservice.

Rejected

Daniel Ting

12/21/2020 Yes

New Chapter leaders should be given an induction by the existing
chapter leader, and if there are no current chapter leaders, the
OWASP Foundation staff, or Chapters Committee, is responsible forproviding an induction.

Rejected

See Handbook

WhoEmail-dateMember?

Comment

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Daniel Ting

12/21/2020 Yes

Access to OWASPFoundation Shared
Services

Access to OWASPFoundation Shared Services
within a reasonable time

Daniel Ting

12/21/2020 Yes

Attendees do not need
to be members. All
members of the public
are allowed to attend
OWASP meetings.

Attendees do not need to be
Accepted
members. All members of the
public are allowed to attend
OWASP meetings. However,reasonable restricted Chapter
events and activities may beorganised.

Daniel Ting

12/21/2020 Yes

Chapter meetings must, Chapter meetings must, to the Rejectedto the extent possible, be extent possible, be free;
free
however, if necessary, may
charge a minimal token fee tocover costs, and where
physical space is limited.

Daniel Ting

12/21/2020 Yes

OWASP Chapters cancreate and manage theirown social media
presence. Access tothese accounts must be
shared with all Leadersof that Chapter, andadministration of theaccount handed over tothe Chapter when
stepping down.

Daniel Ting

12/21/2020 Yes

Chapter Leaders should use a “shared Chapter Mailbox” (such as anchapter-location@owasp.org Google Groups email) for all official
Chapter communications, over individual leaders’ owasp.org accounts.
This helps ensure that there is historical record, and visibility for all
current, and future Chapter Leaders.

Rejected

Daniel Ting

12/21/2020 Yes

If reasonable efforts have been made to attempt to utilise sharedservices, but no reasonable response within 7 days has been
provided, the Chapter may with due care seek a reasonable
alternative.

Modified

Daniel Ting

12/21/2020 Yes

Student chapters in a city which has an active city chapter shouldmake meaningful efforts to collaborate with the city chapter.

Accepted

RejectedOWASP Chapters can create Accepted
and manage their own social
media presence, and otherreasonable communication
channels. Access to theseaccounts must be shared withall Leaders of that Chapter,and administration of theaccount handed over to the
Chapter when stepping down.

Notes

Who

Email-dateMember?

Comment

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Daniel Ting

12/21/2020 Yes(The original language above is very punitive, and worded that oneChapters are overseen
Chapters are overseen on an Modified
strike out. There are a lot of policies, and mistakes happen. How many on an operational basis operational basis by theof you reading this have jaywalked before? Should you be fired from by the Chapters
Chapters Committee, theyour job, and put in jail for jaywalking, or some obscure rule, that
Committee, the OWASP OWASP Foundation Staff,
doesn’t harm anyone?
Foundation Staff, and,
and, ultimately, the OWASPI don’t think so. Likewise here. Let’s approach this with empathy. We’ ultimately, the OWASPBoard of Directors. If there here because we care, not malice. Added the below to support this. Board of Directors. If the Chapters Committee,
The leaders have given much to the foundation, the least you can do
Chapters Committee,
Foundation Staff or Board ofis at least hear them out! It could very well be a misunderstanding, or Foundation Staff orDirectors determines that asomething culturally different. )Board of Directors
Leader has persistently notdetermines that a Leader complied with these rules,
has not complied withdespite support and outreach,these rules, leadershipleadership may be revoked.
will be revoked.
This may include, OWASP
Additionally, OWASP
administrative accessadministrative access(including the leader’s owasp.
(including the leader’sorg email address) may
owasp.org email
immediately be revoked.
address) will
immediately be revoked.

Daniel Ting

12/21/2020 Yes

Where possible and reasonable, the Leader shall first be afforded theopportunity to understand the claims made against them, rectify thefault, and provide a defence before any reprimands and penalties
takes place. Should the Leader be not satisfied with the outcome, thedispute resolution process will apply.

Rejected

Notes

Drop
"persistently".
Keep "may".
Add "orsuspended,
etc."

Who

Daniel Ting

Email-dateMember?

12/21/2020 Yes

Comment

Current Text

(It is not the Chapter leader's duty to always be across all thecommittee's decisions and policies. There's just so much. You can't
expect everyone to know all the policies inside out!)(Don’t do crimes
and violate local laws okay? Also, OWASP pls help support us tofollow the laws. US Laws =/= Local laws globally. Thanks)

Code of Conduct andother relevant policies

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

ADD:
Rejected
Chapters with the appropriate
assistance of the Foundation,
All leaders must follow
shall in best effort identify andand adhere to allcomply with local legal, risk
OWASP Foundationand other compliance
Policies and Procedures, requirements that the chapter
which are in a central
operates in.
repository. As a USbased 501 (c)(3) nonThe Foundation and Chapters
profit organization,
Committee shall makeOWASP must follow
adequate reasonable efforts
specific financial andto help educate Chapter
legal guidelines that can Leaders, and comply with allchange from time toapplicable policies,
time.
procedures, Foundation
bylaws, and local and
Chapters operate with a international legal andgreat deal of freedom;regulatory requirements.
however, Chapters mustabide by the latest
approved Code of
Where the demands of these
Conduct, Foundation
compliance requirements
bylaws, and theseconflict, as soon as possible
policies and procedures. Chapter Leaders shall notify
Copies of older versions the OWASP Foundation via
are not relevant.
the Executive Director, toseek a reasonable
Individuals, and entities resolution/variation. Where awhich have a history of
local regulatory requirement
violating the Code ofwhere the local Chapter
Conduct, and/or theoperates conflicts with any
safety of the Chapter
Foundation policy, best
activities may be denied reasonable efforts to comply
access, and/or
first, with local legal andparticipation in any
regulatory requirements.
ongoing and future
Chapter activities.
Where necessary, Chapters
may adopt variations to thecontents of this policy byagreement with the Chapters
Committee or the OWASP
ED.

Notes

Who

Email-dateMember?

Comment

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Daniel Ting

12/21/2020 Yes(If data doesn't exist, no risk of breach.)

OWASP membership
ADD:
Acceptedand participation in
Unless where required bychapter meetings are
local legislation, or
subject to the EU GDPR, compliance requirements,
and any other locally
Chapter should whereapplicable data
possible adopt a dataprotection regulations.
minimisation approach, andChapter leaders are not delete or not retain data that ispermitted to shareno longer necessary.
member lists, event
attendees, or private
information with third
parties except whereoperationally necessary
and only after informing
relevant parties with optin acceptance.

Daniel Ting

12/21/2020 Yes(Making room for local donations. International conversion andtransaction fees can take quite a chunk out of small ticket donations
that require local tax compliance.)

All donations mustcomply with theDonations policy andprocessed through the
OWASP Donations
page.

Daniel Ting

12/21/2020 Yes

Payments
Payments for training, workshops and other attendee-limited events
must be collected via…(some owasp defined platform).

All donations must comply
with the Donations policy andprocessed through the
OWASP Donations page.
Donations may be processed
via OWASP Foundations’regional entities’ platforms
where necessary to comply
with local regulations.

Rejected

Modified - andother events

Notes

Who

Email-dateMember?

Comment

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

Daniel Ting

12/21/2020 Yes(Explain the impact and to not do crimes that violate local andinternational laws :D )Finances are via
OWASP Foundation
only.

ADD:
Holding and handling money
typically comes withsignificant local regulatory
As Chapters are notrequirements and obligations
legal entities, allthat vary within a country andmembership dues andglobally. By not handlingfunds must be
money locally by the chapter,
processed through thethis allows the Foundation toFoundation for
better comply with regulatorytransparency, the US not requirements, and minimise
for profit laws,
the risk to leaders. If local
regulatory, and tax
regulatory obligations requirecompliance reasons.
that funds be handled locally,
speak with the Executive
Chapters are not
Director to discuss options.
permitted to hold any
bank accounts,
independent insurance,
have an independent
donation mechanism, or
use any funds transfer
mechanisms to store
financial value such as
gift cards, PayPal or
Venmo, or any otherbanking or financial
instruments.

Rejected

Daniel Ting

12/21/2020 Yes( Should we have a conversation here about signing up for online
accounts and services? Eg. Twitter/Streamyard etc.
How are these treated and handled? If the TOS is being agreed to as
an individual or by the foundation? If the prior, might be legally hard toclaim ownership of accounts. You can’t quite have it both ways. )No signing authority

Accepted

ADD:
All such agreements should
Chapters operate under be referred to the OWASP
the aegis and policies of Foundation for pre-approval
the OWASP Foundation and possible signing.
and are subject to the
OWASP Signing policy.
As non-legal entities,
chapters leaders andmembers of chapters
cannot sign contracts orenter into agreementswith commercialorganizations.

Notes

Who

Daniel Ting

Email-dateMember?

12/21/2020 Yes

Comment

Current Text

(Add response SLA, and to let leaders know of the impact, that this is
for regulatory compliance reasons.)

Chapter Supporters andbartering arrangements

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)

ADD:
Rejected
The Foundation shall provide
an actionable response to any
agreements filed via JIRA
within 7 calendar days.

Chapters areencouraged to obtain
local chapter supporters
via bartering
Failure to do so may result inarrangements (i.e.
personal liability for said
services, event spaces, agreements, as well asor food and beverages
potentially violate required
are paid for by a chapter regulatory reporting.
supporter) and donations
via the OWASP website.
Chapters can definelevels and benefits oflocal Chapter
Supporters, including
logos on introduction
slides and the Chapter
home page. Any
contractual agreement,
bartering arrangement,
or financial transaction
must be registered andprocessed by theFoundation.
Harold Blankenship

1/11/2021 Yes

Remove the following parts of the policy because these things arebeing automated:
Any changes in chapter leadership must be done by submitting a ticketwith all information to the New Chapter/Leader Request by one of theexisting Leaders.
If a leader needs to step down, they must send an email to theFoundation or submit a ticket to the New Chapter/Leader Request.

Modified should submit,
allowing forautomation toalso take careof it.

Notes

Who

Andrew van der Stock

Email-dateMember?

1/15/2021 Yes

Comment

Current Text

Suggested Text

Add Section:
Sanctioned Countries andLeaders
OWASP must comply withinternational laws andregulations, includinginternational sanctions.
Sanctions take many forms
and are often limited in scopeto access to specificintellectual property,
organizations, governments,
and/or individuals.
From time to time, theExecutive Director andChapter and Membershipmanager will review sanctions
from the EU, USA, andanywhere else the Foundation
has an operating entity, andapply the following policies.
Until sanctions are lifted andwhere not complying with orbreaching sanctions would
cause the OWASPFoundation to be subject tofines, civil or criminal liability,
the following policies will beapplied:a) New chapters cannot be
formed.
b) Existing chapters may be
disbanded or madeindependent of theFoundation depending on thenature of the sanctions.
c) Leaders and members whoare sanctioned individuals will
be removed from any
leadership positions, and any
membership fees refunded,
including Lifetime
membership.
d) Access to OWASP
materials are free and opensource, and can be obtained
through many means,including OWASP's sharedcloud platforms. For the
purposes of curtailing accessor prohibiting the "export" ofsuch freely available
information, OWASP relies
solely upon the technicalcontrols in place by ourshared cloud platforms, whichshare the same sanction
controls as the OWASPFoundation. The Foundation
has no control over these

Status(Accepted /Rejected /Modified /Duplicate)

Accepted

Notes