A Deep Dive Into
Open Source Program Offices
Structure, Roles, Responsibilities,
and Challenges
August 2022
Ibrahim Haddad, Ph.D.
Vice President of Strategic Programs, Linux Foundation
and General Manager, LF AI & Data
With a foreword by Chris Aniszczyk,
Chief Technology Officer, Linux Foundation
and Co-Founder, TODO GroupIn partnership with:

Contents
Foreword............................................................................................... 3

OSPO Responsibilities....................................................................... 15

Abstract ................................................................................................ 5

Develop and Execute an Open Source Strategy ................................................ 15

Introduction ......................................................................................... 6

Oversee Open Source Compliance........................................................................ 19

OSPO Definition................................................................................... 7

Establish Open Source Policies and Processes .................................................. 21

OSPO Characteristics........................................................................... 7
OSPO Maturity Model.......................................................................... 8Stage 0: Ad-Hoc Approach ....................................................................................... 9Stage 1: Legal-Driven Adoption............................................................................... 9Stage 2: Community-Driven Adoption................................................................... 9Stage 3: Engagement-Driven Adoption................................................................ 10
Stage 4: Leadership-Driven Adoption ................................................................. 10

OSPO Structure.................................................................................. 11
Example 1: OSPO Within an R&D Department................................................... 11
Example 2: Corporate-Level OSPO With Supporting Division-Level OSPOs .12
Example 3: OSPO as Part of the CTO Office or Engineering Department .... 12

Prioritize and Drive Upstream Open Source Development ............................22
Engage with Open Source Organizations............................................................22
Track Performance Metrics ...................................................................................22

OSPOs and Eliminating Friction From
Using or Contributing to OSS ........................................................... 25
Culture........................................................................................................................ 25
Processes.................................................................................................................... 26
Continuity.................................................................................................................. 26
Education................................................................................................................... 27

The TODO Group ................................................................................ 28
Conclusion..................................................................................................................28

Example 4: Virtual OSPO......................................................................................... 13

Acknowledgments............................................................................. 29

Example 5: No Official OSPO.................................................................................. 13

Linux Foundation Resources ........................................................... 29

Staffing an OSPO ............................................................................... 14
Head of OSPO ........................................................................................................... 14
Software Architect .................................................................................................. 14
Technical Evangelist ................................................................................................ 14
Compliance Engineer .............................................................................................. 14
Legal Counsel ............................................................................................................ 14

Feedback............................................................................................. 29
About the Author............................................................................... 30
Disclaimer........................................................................................... 30

Foreword
If you're like most corporate leaders, you're likely to be familiar withThe TODO Group is a group of organizations that are committed toopen source and may even already have an open source program inbuilding the best practices and tools for managing successful open

place. But what exactly is an Open Source Program Office (OSPO), whatsource programs. We are the leading voice on all things related to open

roles and responsibilities does it have, and how can it contribute to yoursource program management, with a growing community of practiceorganization's success?

that includes some of the world's largest organizations. We encourage

An OSPO is a corporate entity that is responsible for managing andcoordinating an organization's open source activities. The OSPO can be

you as a practice leader, or someone who is thinking about setting up
an OSPO, to join us.

seen as the central nervous system for an organization's open sourceThis paper is an introduction to setting up an OSPO. It covers the what,strategy, and it provides governance, oversight, and support for all

why, and how of open source program management, with a focus on

things related to open source.

the role of an OSPO and the benefits. It also includes descriptions of

At The Linux Foundation, we view OSPOs as critical components ofsuccessful organizations. We've seen firsthand how an effective OSPO
can help an organization achieve its business goals and objectives by

various structural models for OSPOs and provides tips and best practices for success. We hope that you find it helpful as you embark on
your open source journey.

leveraging the power of open source. The TODO can help you set up an

Chris Aniszczyk

OSPO or take your existing program to the next level.

CTO, The Linux Foundation
Co-Founder, The TODO GroupA DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

3

OSPO BENEFITS: PROCESSESOSPO is designed
to be the center ofcompetency for an
organization's open
source operations andstructure.

OSPOS
IN THE ORGANIZATIONOSPOs may exist
unoﬃcially;
virtually; within research and
OSPOs may exist unoﬃcially;
development (R&D), engineering,virtually; within research andor other corporate departments;
development (R&D), engineering,or in executive-level oﬃces ofor other corporate departments;
the Chief Technology Oﬃcer
or in executive-level oﬃces of(CTO) or Chief Legal Oﬃcer.
the Chief Technology Oﬃcer(CTO) or Chief Legal Oﬃcer.

WHY FORM AN OSPO?

OSPO STAFF

OSPO BENEFITS: TOOLSWHAT IS AN OSPO?

Organizations across industries
establish OSPOs to drive OSS

leadership and gain acritical foothold in a robust,external R&D ecosystem.

CHARACTERISTICS OF OSPO MATURITY
Mature OSPOs oversee
OSS consumption,
governance, strategy,
contribution, processes,
and tooling.

OSPOs can be run by any
distinguished individuals withsuch as software architects,
strongsets
of skills, compliancetechnical
evangelists,such
assoftwarearchitects,
engineers, and legal
counsel.
technical evangelists, complianceengineers, and legal counsel.
OSPO RESPONSIBILITIESThe OSPO assumes diﬀerent responsibilities
that change over time, including developing

and executing the open source (OS)strategy, setting priorities, tracking
performance, and leading community
engagement.

OSPO MATURITY MODELOSPO BENEFITS: CULTURE

OSPO maturity evolves in thefollowing stages: ad-hoc adoption

OSPOs help to bridge thecultural gap between-> legal motivations ->community-driven ->engagement-driven ->leadership-driven.

traditional softwaredevelopment practices
and the requirements ofopen source development.

Copyright © 2022 The Linux Foundation | August 2022
This report is licensed under the Creative Commons Attribution-NoDerivatives 4.0 International Public License

OSPOs oversee the establishment or
adaptation of internal policies tobetter manage open source
software (OSS) compliance infast-moving, dynamic
environments.

OSPOs help to implement
unique and ﬂexible sets oftools that support OSS
development models

while meeting
corporate Information
Technology guidelines.

OSPO BENEFITS: CONTINUITY
As organizational needs or
strategies evolve, OSPOs enable

continuity in executive
support, funding, softwaredevelopment practices, andOSS project prioritization.

OSPO BENEFITS: EDUCATIONOSPOs improve technical,
mentorship, andcompliance-related
education and training
programming for teammembers across all levelsof the organization.

Abstract
Open source projects and initiatives provide enterprises with proven,successful models to collaborate with other organizations, create
new technologies, and support the development of new communities. Organizations across many industries are establishing Open
Source Program Offices (OSPOs) and staffing them with highly skilledindividuals to drive open source software(OSS) leadership and gaina critical foothold in this external research and development (R&D)
ecosystem.
This report examines how enterprises structure their OSPOs and therequired minimal staffing needed for their operation, discusses the
responsibilities of such offices, and elaborates on the challenges thatare faced in open source enterprise adoption.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

5

Introduction
The availability of open source software (OSS) is changing how organi-and services. In addition, it helps to accelerate product development

zations develop and deliver products. The combination of a transparent

and enables a faster time to market by aligning business needs with

development community and access to public source code enables orga-

upstream open source projects. Organizations do not get involved innizations to think differently about how they procure, implement, test,

open source projects because it is fun; they do it because it is a part of

deploy, and maintain software (FIGURE 1). OSS has created an ecosystem

their business or product strategy. OSPOs often manage and orches-with a wealth of benefits for all those involved. Organizations of all

trate that involvement.

types, across all industries and domains, are racing to build and growtheir open source operations under an Open Source Program Office(OSPO) to help them use and contribute to open source more efficiently
and effectively and benefit from its strategic impact (FIGURE 2).

FIGURE 1

The first step in establishing an OSPO is understanding that open
source is key to mastering software engineering, as almost every
software product that exists today relies on OSS. Leading organizations in a growing number of industries have established their position

OSS allows shared development and lowers research and development

by becoming leaders in software development, and OSS is a critical(R&D) costs by enabling organizations to reap the benefit of billions

component of this leadership. The second step is the availability ofof dollars of OSS, which they can harness to create better products

an executive sponsor within the organization who will support the1

2
Neutral environment
for collaboration &cross-pollination

Open source isa technology
marketaccelerant
63Innovation multiplier –community driven

7
Qualiﬁes referencearchitectures

4
Minimizes
fragmentationand supports
theupstreamdevelopment
upstream development
model
model

8
Lowers barriers to entera new domain

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

Enables betterinteroperability

Facilitates
standardization on
open technologies

upstream development

9
Enables business
opportunities supported
by a ﬂexible
licensing
upstreamdevelopment
model
model

6

5

10
Leads to better
products, improved
qualityandsecurity
upstreamdevelopment

Allows fast trailingtwelve months
and shared cost ofdevelopment

establishment of an OSPO, provide funding for it, and offer a long-term
commitment to improving and growing open source engineering in

FIGURE 2

the organization. This person also plays a critical role in identifying a

Strategic impact of OSS

trusted open source leader who can create and develop the OSPO.

OSPO Definition
An OSPO is designed to do the following: (1) be the center of competency for an organization's open source operations and structure Accelerate thedevelopment ofopen solutions

 Commoditize a market

 Provide an
implementation
to an open standard

 Share development costs

 Reduce prices ofnonstrategic software assetsand (2) place a strategy and set of policies on top of an organization's Driveopendemandby building Partner
withcodeotherssourceefforts. This can include
settinguse, distribution,an ecosystemforselection, auditing, and other policies;
training
developers; ensuring
 Engagecustomers
products & services
legal compliance; and promotingbuildingrelationships
community engagement
 andStrengthen

to benefit the organization strategically.
See thegoals
OSPO definition by thewith common
TODO for more information.

OSPO Characteristics
To a certain degree, an organization calling itself an OSPO indicates thatthe organization has reached a mature stage, gained critical mass support
with its enterprise, and manifests the following five key characteristics:

Commoditize a market
Reduce prices ofnonstrategic software assets
Share development costs

 Drive demand by building
an ecosystem forproducts & services

 Partner with others

1.

Employees are tasked with fostering and nurturing OSS usage.

2.

The organization has a formal policy regarding the use andproduction of OSS.

 Engage customers
 Strengthen relationships
with common goals

3.

Executives recognize that OSS and open source are important
strategic assets.

4.

Significant numbers of employees are contributing code to open
source projects.

5.

Processes, procedures, and tools are in place to streamline andfacilitate open source consumption and participation.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

7

OSPO Maturity Model
To better explain the evolution of OSPOs, the TODO Group has developed a model (FIGURE 3) to assist organizations in determining their OSPO andidentifying the elements that need to be implemented to advance the maturity of their OSPO. This model is composed of the following two variables and five stages:

MODEL VARIABLES:

MODEL STAGES:• Y variable: Ability to execute.

• Stage 0: Ad-hoc adoption.

• X variable: OSPO level.

• Stage 1: Legal-driven.
• Stage 2: Community-driven.
• Stage 3: Engagement-driven.
• Stage 4: Leadership-driven.

FIGURE 3

Maturity
stages of
OSPOs

high

Leadership
Becoming a Strategic
Decision-Making Partner

Stage 4Engagement

Source:Stage 3

Hosting OSS Projects andGrowing Communities

TODO Group
Community Education

Ability
to execute

Stage 2

Evangelizing OSS Use and Ecosystem Participation

Legal Education

Stage 1

Providing OSS Compliance, Inventory, Developer Education

Adoption

Stage 0Adopting
OS Ad Hoc

low
null

OSPO Level

low

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

8

high

Stage 0: Ad-Hoc Approach
Nowadays, almost all organizations use OSS, although how they adapt
and initially use it varies. They may use OSS as a building block orlibrary in a product or tool, a key part of a vendor’s solution stack, orin support of their service offering. Modern cloud native applications,

In general, an organization forms an OSPO when it
realizes that its people are consuming open source
products and code across nearly all engineering

almost by default, use open source systems for container orches-and development departments and functions. This

tration, observability, data storage, messaging, and more. In otherusage is typically internal rather than part of its

words, nearly every organization is using open source. However, theearliest form of adoption is ad hoc due to developers solving problems

products or services to its customers or users.

using readily available tools and technologies. This “ad-hoc adoption”
usually means that little thought is given to license compliance outside
the basic defaults or to the longer-term impacts of consuming OSS anddistributing products that are built with OSS components.

Stage 2: Community-Driven Adoption
EARLY STAGE

Stage 1: Legal-Driven Adoption
In general, an organization forms an OSPO when it realizes that its
people are consuming open source products and code across nearly
all engineering and development departments and functions. This
usage is typically internal rather than part of its products or services
to its customers or users. At this early stage, organizations often use
many different names for the OSPO. For example, IBM initially called
its programmatic open source efforts the “Open Source Steering
Committee.”

After organizations recognize the value of OSS and the need forcompliance, education, and a Software Bill of Materials (SBOM), they
begin to realize the economic benefits of OSS usage and seek to expand
it. OSPOs in Stage 2 create such internal mechanisms as ambassadors who promote the usage of approved OSS products, educational
programs on good OSS hygiene, and technical training or tuition reimbursement for OSS skill building and certification. With these initiatives,
an organization can grow its use of OSS and amplify its message thatOSS is not only important but also desirable and preferable to propri-

Organizations in Stage 1 recognize that OSS is a key part of their

etary software.

business and technology strategies. They understand that the security
practices of OSS projects differ from those of proprietary softwareorganizations.

When advancing in this stage, organizations begin encouraging their

Organizations must identify their legal and security risks. The risk mitigation strategies include the following:developers to work on OSS projects that are critical to their operations
to the extent that the developers become highly active contributors or
primary maintainers. During this stage, OSPOs begin to streamline and• Compliant licensing.

optimize open outbound source contributions for their developers andcreate and launch open source projects to establish broad credibility in• Developer education.

the open source community.

• Inventory-tracking.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGESGROW TH STAGE

9

Stage 3: Engagement-Driven Adoption

Stage 4: Leadership-Driven Adoption

During Stage 3, organizations initiate and host or act as primary

During this maturity stage, the OSPO becomes a strategic partner

sponsors of OSS projects. They will dedicate one or more full-time

for technology decisions, guides choices, and shapes long-term

employees to a project, and they accept responsibility for nurturing acommitments to projects. Additionally, the Chief Technology Officer

project community and ensuring its health. They do not confuse this(CTO) and other technology leaders consult the OSPO and its leadershiplevel of organizational commitment with individual employees who

on which open source technologies to rely and which decision criteria

decide to open source their projects. Additionally, during this stage,to use in judging open source projects. Because major open source

organizational leaders support incubating and launching OSS projects

technology choices tend to generate significant secondary and tertiary

into the public sphere because they understand how these projects

costs and affect both upstream and downstream technologies andbenefit their organization. Such projects tend to offer improved perfor-

hiring plans, the choice of open source projects becomes a major

mance and economics on crucial capabilities that may be noncore

business decision. The following three main types of strategic guidance

to the organization’s value proposition but critical to its technology

take shape in this final stage:

infrastructure.

1.

technologies to adopt/remove from the organization’s technology

Additionally, during this stage, the OSPO develops several mechanisms

stack.

to vet, organize, and operate open source projects and prepare andcoach their leaders, such as the following:

2.

Take the lead on benchmarking what constitutes an acceptable
OSS project.

• Internal processes.
3.

• Playbooks.
• Checklists.
• Tooling.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

Advise the CTO and technology leadership on open source

10

Help organizations understand and navigate project politics.

OSPO Structure

FIGURE 4

OSPO structured within an R&D organization

In this section, we explore common OSPO structures. It is importantto keep in mind that no two organizations are the same. Therefore,

Head of R&D

there are no cookie-cutter OSPO structures. Instead, many organizations, including those with a long record of open source involvement,
experiment with different setups. Generally, an organization’s goal isOSPO

to find the most suitable and efficient structure based upon its overall
software strategy, open source aspirations, reliance on OSS in products,
unfilled positions in open source, and other factors.

Engineering

Strategy

SupportExample 1: OSPO Within an R&D Department
OS & System
Libraries

Policies andProcesses

Graphics

Technical
Evangelism

A common placement for an OSPO is within an R&D organization.

Tooling + IT

For instance, the author of this paper adopted this model (FIGURE 4)
when he was hired by Samsung in early 2013 to establish Samsung’s
Open Source Group. In this example, the open source leader owns

Compliance

open source engineering, and the strategy and support functions, andreports directly to the head of R&D. The Samsung OSPO has a dedi-

Media

Developer
Relations

EventsIoTOpen Source
Foundations

Corporate
Development

Cloud

Open
Standards

SoftwareProcurementcated budget to cover the head count, travel, and sponsorship costs foropen source events, membership dues for open source foundations,hardware and software expenses, and various other miscellaneous
expenses (including promotional items, such as tee shirts, hats, etc.).
This specific setup has worked very well for many years.
There are two main reasons to structure the OSPO under an R&D
function (or department). The first is to isolate the group from productdivisions, thereby preventing it from becoming an auxiliary development arm for those divisions. This setup allows the OSPO to maintain aAIcertain level of independence, both financially and in terms of projects,
so it can focus on open source technologies of the highest priority
without being influenced by any product division. The second reason to

Etc.

structure an OSPO within R&D is to better support efforts that involve
external parties, such as other organizations and universities, awayfrom daily product pressures.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

11

Example 2: Corporate-Level OSPO With
Supporting Division-Level OSPOs

The supporting OSPOs are responsible for executing the open
source strategy at the division level, ensuring staff follows the corpo-

This model (FIGURE 5) works best in large organizations withmultiple product divisions. It consists of a corporate-level OSPO,
which coordinates the activity of multiple supporting OSPOs at thedivision level. The corporate OSPO is responsible for establishingorganization-wide policies and processes, deciding on the strategy,

rate policies and processes, delivering training, and in many cases,
managing upstream open source engineering. The corporate OSPO
may not have any engineering resources, except for a principal engineer
or a senior architect, to provide technical expertise and leadership.

initiatives, and managing open source matters at the corporate

Example 3: OSPO as Part of the CTO
Office or Engineering Department

level in general.

In medium-sized organizations, it is common to house the OSPO either

working with open source foundations, driving major open source

within the engineering department or under the CTO office. This OSPO
structure typically has a dedicated budget that is managed by the executive sponsor (Sr. Vice President of Engineering or the CTO). Although
the OSPO may have its own budget, all spending and any external

Corporate-level
OSPO withsupporting
division-level
OSPOs

commitments require the approval of the executive sponsor. The OSPOCEO Oﬃce

FIGURE 5

might have dedicated engineering resources that work on upstream
projects depending on the organization's needs. FIGURE 6 illustrates

Business Unit 1

Business Unit 2

Corporate CTO

SVP Engineering(or Division
CTO Oﬃce)

SVP Engineering(or Division
CTO Oﬃce)

CorporateLevel OSPO

Division OSPO

Division OSPO

these two scenarios.

FIGURE 6

OSPO as part of the engineering department or the
CTO office (with dedicated open source developers)

Strategy
Compliance

CEO Oﬃce
CEO Oﬃce

Engineering

Engineering
Engineering

SupportOSPOOSPOOSPOOSPO

SourceOpen Open
SourceDevelopers
Developers

SourceOpen Open
SourceDevelopers
Developers

Etc.
A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

12CEO Oﬃce
CEO Oﬃce

Engineering
Engineering

CTO CTOFIGURE 7

Example 4: Virtual OSPO

Virtual OSPOThe virtual OSPO (FIGURE 7) is a common setup in an organization thathas a head of open source, which is typically within the engineering

CEO Oﬃce

department, without any dedicated staff. The head of open source
works with a virtual OSPO staff comprising individuals from different

Engineering

Legal

MarketingOpen SourceCounselOpen Source
Developer
RelationsITteams, such as legal, engineering, and marketing, each of whom dedicates a certain percentage of their time to support open source activ-

Platform

Open Source IT& Toolingities. A virtual OSPO does not typically have a dedicated budget;
instead, the budget for any open source spending would come from theengineering department or CTO office.

Services

Example 5: No Official OSPOThis example (FIGURE 8) is of an organization that does not have

Hardwarean official OSPO. This is a typical setup in smaller organizations
and start-ups where different individuals fulfill the duties that are

Head ofOpen Source

associated with an OSPO. Although this structure provides more
flexibility for smaller organizations, it is difficult to scale as theorganization grows.

FIGURE 8

Engineering

Individuals (represented bycolored circles) fulfill
the duties of an OSPO ina smaller organization

Legal

CEO Oﬃce

MarketingCorporate
Development

IT
A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

13

Staffing an OSPOThe staffing of an OSPO depends on many variables. However, several

The TODO Group has published a template job specification for thisroles are required, regardless of the specific structure of any given OSPO.

role that you can customize to your needs.

These roles do not have to be distinct positions. In some cases, distinguished individuals with strong sets of skills can fulfill more than one role.

Software Architect
We believe that it is mandatory for an OSPO to have a senior software

Head of OSPO

architect or principal engineer to act as a high-level technical deci-

The head of the OSPO is often called the director or vice president ofsion-maker on topics that are related to OSS: from design choices toopen source, depending on the size of the organization and the open

technical standards, such as platforms and coding standards.

source team. The head of open source is responsible for managing
and executing organization-wide open source strategies and businessTechnical Evangelist

metrics to track the business and technical success of the program.

A technical evangelist is an individual with a strong technical back-

Depending on the structure of the OSPO, the office leader could also
be responsible for open source engineering resources, ensuring open
source compliance, representing the organization among open source
organizations, and participating in open standards efforts.

ground whose primary role is to evangelize the open source contributions and solutions that are developed by the open source group to theorganization’s customers, prospects, and partners, and the open source
community in general. They are responsible for running demonstrations
at events, delivering technical presentations, creating documentation,

This individual should possess the following traits:• A strong engineering background and experience insoftware development.

and generally building support to a critical mass for a given technology.

Compliance Engineer• Contacts with open source organizations.

The compliance engineer supports the execution of the organiza-• A comprehensive understanding of open source licenses.

tion’s compliance policy and process and ensures that the organization• Knowledge of industry best practices.

and services. Some OSPOs have complete ownership of the open

• Knowledge and experience in establishing corporate-wide

source compliance function; in these cases, the OSPO may need to hostmultiple compliance engineers.

policies and processes.
• Technical knowledge related to the organization’s

Legal Counsel

products and services.

It is rare for an OSPO to have legal counsel among its staff. In most• Historical perspective of open source.
• Knowledge of how various technical project communities
operate.
A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

fulfills all license obligations for the OSS that is used in its products

14cases, having access to a legal counsel that is versed in open source
licensing is sufficient for small and medium-sized organizations.

OSPO Responsibilities
The OSPO assumes different responsibilities that change over time. In

OSS is changing how organizations develop and deliver products. With

the following subsections, we explore these responsibilities and discussopen access to source code and transparent development communities,

them at length. You can also explore these responsibilities in this inter-

software providers can reduce development costs while remaining active

active OSPO mind map.

participants in the development process. In addition, end users of thesoftware can also be active in the development process by contributing

Develop and Execute an Open Source Strategy

directly to upstream projects rather than be passive recipients of what

Since the beginning of the software industry, nearly every software

the software vendor delivers to them. This development model enables

organization has followed the same business model as follows: source

organizations to think differently about how they procure, implement,

code was developed by its employees or licensed from a third party,

test, deploy, and maintain software. In this report, we explore theintellectual property was closely held, and software was delivered in afollowing four basic strategies for organizations that utilize and integrate

binary format to its clients. However, the availability of enterprise-grade

OSS in their products: consumer, participant, contributor, and leader.

FIGURE 9

LEADER

The four core stages ofopen source strategy—
consumer, participant,contributor, and leader

CONTRIBUTORPARTICIPANT
CONSUMER
uo

ContinA DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

ndtion aticipaus par15

ion tobut
contrirojectop

rce p
en souFIGURE 9 illustrates the following four primary OSS strategies: consump-tion, participation, contribution, and leadership. Each strategy requiresorganizations to be successful at the previous strategy. How far yourorganization advances up this ladder is entirely dependent upon its
objectives and overall open source strategy.
These four strategies overlap as organizations transition from one

Some organizations can achieve their goals simply
by being consumers of open source code andare content to stay at that level, while others haveambitions to attain certain leadership positions.

position into another. Typically, the early stages are engineering-driven
due to engineers using open source components in product development. Initially, their participation in strategic projects may be limited
to joining the conversation or making small contributions. Over time,
this usage can grow within the organization and become part of thebusiness strategy as it gains traction.

obligations and identify any known security vulnerabilities.
• Deploy automated workflow software for evaluating/approving
open source usage.

Some organizations can achieve their goals simply by being consumersof open source code and are content to stay at that level, while others
have ambitions to attain certain leadership positions. As it is likely thatyour organization is already at one of these levels of the ladder, it isimportant to identify both your current position on the ladder and yourtarget position.

• Create a plan for incremental investment in head count andinfrastructure in engineering, product management, and legal tomanage a complex mix of closed and open source software.
When establishing a software strategy that encourages the use of OSS
in commercial products, the following actions can be taken to ensure
the successful adoption of OSS:

Consumer Scenario
The common starting point is the adoption of OSS and integrationof OSS in products and services. Voraciously consuming open sourcecomponents will increase your ability to differentiate products andservices and reduce your overall time and costs in delivering those
products and services. The following action items are essential tothis strategy:• Communicate the strategy for the use of OSS.
• Educate staff on open source compliance, license obligations, andthe open source development model.
• Establish explicit criteria for determining which OSS is a candidate
for inclusion in your products. Examples include the availability of
new features, the maturity of the project’s source code, the size

• Set up an open source review board to serve as a clearinghousefor all open source activities, including license compliance.
• Use a strategic classification scheme to guide decisions on what
OSS to consume.

and composition of the project’s development community, andother factors that measure the state of the code and the people
who maintain it.
• Establish an open source compliance program to ensure that you• Create an inventory of all software that is used via SBOM toenable a more granular view of the licenses of the OSS in use to

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

determine whether the enterprise is complying with all license

16

have the processes in place to meet the license obligations of the
OSS that you are using in your products.

• Encourage your developers to identify and adopt open source
development tools that can enable better internal collaboration,
increased and transparent team communication, and fasterOnce your organization is successfully using OSS in
products or services, you can expand your strategy
to participate in the open source community.

development cycles.
• Encourage your staff to subscribe to open source mailing lists andmagazines, follow blogs, and participate in discussion forums.
• Encourage and fund staff’s attendance at open source
conferences for learning and networking opportunities.
• Join open source industry bodies and foundations, such as The
Linux Foundation, for opportunities to share development andlegal best practices with other leaders in the industry.

Once your enterprise realizes the benefits of participating regularly inthe community, you can assess the advantages of contributing code to
projects and communities. As code contributors help to shape futurefeatures, contributing source code to those open source projects thatare critical to your business objectives is the best way to influence thoseprojects and build a positive reputation. The following action items are• Hire developers from the open source community.
• Host local open source user groups and encourage your staff to
get involved in local open source activities.
• Invite community members to present to your development teamon topics that are related to the project.

essential to this scenario:• Educate your team on community development best practices.
• Actively participate and drive technical discussions on the mailinglist, Slack, discussion forums, etc.
• Follow the open source community’s established working

Participant Scenario

methods and processes.

Once your organization is successfully using OSS in products orservices, you can expand your strategy to participate in the open
source community. Unless you have already hired experienced developers, you may need to engage more closely with the community,
increase your visibility, and begin attracting the talent that you need.
The following action items are essential to participation:• File bug reports and contribute fixes to existing bugs.
• Contribute code to improve or extend functionality.
• Contribute code to implement new features.
• Contribute bug fixes or other security measures• Monitor community communication platforms, such as chatservers, mailing lists, forums, and websites, to keep on top of
project developments.
• Attend relevant conferences and meetups to establish
relationships within the community.
• Sponsor project events and foundations to improve the• Contribute to documentation efforts.
• Contribute to testing and integration efforts (e.g., write test code,
create test cases).
• Listen to feedback on your contributions and act on it.
• Establish trust with the project maintainer and other project
participants via your contributions and active participation.

enterprise’s visibility.
A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

Contributor Scenario

17• Hire a staff director to lead the open source strategy and manage
the OSPO.		
• Hire contributors and committers to open source communities
that are vital to your products and services.
• Deploy open source collaboration tools to support open source
usage and contributions.

 Demonstrate good faith by contributing (when relevant)
proprietary source code from internal development to open
source projects under an appropriate open source license thatmakes it usable and useful to the community.
• Publicly acknowledge that the organization has achieved tangible
benefits by working with open source communities for criticalsoftware product development.

• Invest incrementally in engineering, product management, andlegal resources to engage with external communities.

• Empower employees to seek maintainer status within the project.
• Sponsor events, provide financial support for project

Leadership Scenario

infrastructure, and consider hiring recognized open source

The highest form of open source strategy is leadership. Open source

developers from within the project.			

leaders earn their strategic positions by establishing trust with project
members and maintaining a high level of continuous contribution.
Leading organizations can capitalize on emerging trends in technology.

• Increase participation in relevant open source organizations andfoundations.
• Lead architectural and requirement-gathering initiatives within

This scenario requires significant investment in targeted open source

the various communities and consortia to achieve commercial

communities and consortia to establish a leadership agenda. In

objectives.

addition, it will require incremental investment primarily in engineering,product management, and legal to establish leadership in external
communities and industry consortia. Below are some of the tacticalsteps that can help steer your organization toward a leadership role
within a specific open source project:

use of and contributions to OSS. 		
While there are numerous strategic objectives to choose from, thefollowing objectives are common among organizations that use andParticipate actively and openly within all aspects of the project, including
planning, development, testing, and release management, thereby
demonstrating your capacity to act as a good steward of the project.
• Achieve a higher level of participation and contribution.
 Engage with the various project participants.

develop OSS:
• Reduce development costs.
• Improve the quality and flexibility of products.
• Achieve a faster time to market for products.
• Increase engineering capacity through community engagement.

 Contribute to patching bugs, adding new features, andextending functionality in existing open source projects using
the best practices, which are outlined above.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES• Establish an open source architect role to proactively guide the18• Broaden and deepen developer community commitment to youropen source efforts.

Oversee Open Source Compliance• Comply with third-party software supplier contractual obligations.

Open source initiatives provide organizations with a vehicle to accel-• Protect commercial product differentiation.

erate innovation through collaboration with open source communities.
One core responsibility for organizations is their compliance with open

OSPOs are generally involved in open source compliance in thesource licenses. Open source compliance is the process by which users,

following two ways:

integrators, and software developers observe copyright notices andsatisfy the license obligations for their OSS components.

1.

They are responsible for implementing and running a complete
end-to-open source compliance program, which includes the policy,
process, tools, automation, education, and final fulfillment ofOpen source compliance helps to achieve the following four main
objectives:

obligations for OSS integrated into products, software, or services.
Or• Comply with open source licensing obligations.
• Facilitate effective use of OSS in commercial products and services.

2.

They are responsible for establishing the organization’s general
open source policies, and the execution and enforcement ofthese policies are pushed into the various divisions across theorganization. For instance, ensuring open source complianceis a great example of a scenario where the OSPO is focused on

FIGURE 10

policies and processes, and dedicated teams on the product side

Ensuring open source compliance is a cross-functional activity

are more trusted than the actual implementation and executionof a compliance program.
The OSPO has a direct impact on the full scale of compliance responsibilities. Regardless of the specific role of an OSPO, it must have at least

Corporate
Development
Legal

one individual who is very knowledgeable in open source licensing,Engineering

compliance practices, and engineering.
The minimum set of individuals that represent the core compliance

Product Teamteam includes a legal representative, an engineering or product repre-

Open Source
Compliancesentative, and an open source compliance expert, who is often aITmember of the OSPO. In the following table, we briefly present the
primary roles of these individuals who form the core open source

Documentation

Supply Chaincompliance team. For a detailed discussion on the topic of open sourcecompliance, please download the free e-book Open Source Compliancein the Enterprise, which was published by The Linux Foundation. The

Localization

e-book is a practical guide for organizations on how best to use open
source code in products and services and legally and responsibly participate in open source communities.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

19

FIGURE 11

Roles and
responsibilitiesof the corecomplianceteam members

CORE OPEN SOURCECOMPLIANCE TEAMPRIMARY RESPONSIBILITIESLegal representative• Review and approve the use of OSS and the contribution to OSS projects.

This representation varies from• Provide guidance on the incoming and outgoing licenses of all software.

a legal counsel to a paralegal,• Contribute to the creation of open source training.

depending on the task at hand.

• Contribute to the creation and improvement of the compliance program.
• Review and approve the content of license compliance documentation and resources.
• Review and approve the list of obligations that are required for each software
component that is included in a product.

Engineering and product team

• Follow compliance policies and processes.

representative• Integrate compliance practices into the software development process.

Some organizations do not• Contribute to improving the compliance program.

distinguish between theengineering and product teams.

• Follow the technical compliance guidelines.
• Respond quickly to all compliance-related questions.
• Conduct design, architecture, and code reviews.
• Implement security best practices.
• Prepare open source packages for distribution.

Compliance representative• Drive license compliance activities, such as the execution of source code audits.

An open source compliance officer• Coordinate the distribution of open source packages as part of fulfillingis not necessarily a dedicatedresource. In most cases, theindividual fulfills the role ofthe manager or director ofopen source.

open source license obligations.
• Contribute to creating compliance training.
• Contribute to improving the compliance program.
• Contribute to the creation of new tools to facilitate the automation and discovery of OSS.
• Sign off on product release from an open source compliance perspective.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

20

Collectively, these three roles (legal, engineering, and compliance) areresponsible for the following three main tasks:
1.

Establish Open Source Policies and Processes
The policies and processes that the OSPO needs to create depend on

Ensuring mutual compliance with third-party software andthe organization’s current and target position on the strategy ladder.

OSS licenses.

During the first stage (consumption), the OSPO needs to implement
an open source infrastructure that can support the consumption and

2.

Facilitating the usage of and contributions to OSS.

3.

Protecting proprietary intellectual property (and productdifferentiation) by ensuring that open source license obligations
do not propagate to proprietary or third-party software.

compliance aspects of OSS. FIGURE 12 illustrates infrastructure that
goes beyond a simple policy to define the organization’s guidelines forusing OSS. It extends to encompass a strategy that covers usage andcompliance, incorporates compliance checkpoints in the development
process, establishes a team to supervise the proper usage of open
source, provides the necessary training, enables tooling, and facilitates
relationships with relevant open source organizations.

FIGURE 12

Enabling
infrastructure
for open source
consumption
and compliance

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

21

show a return on investment across multiple products. In an enterprise setting, where the OSPO and open source engineering are cost

FIGURE 13

centers, the driving force should be to focus on open source projects

Necessary infrastructure for open source contributions

that directly support product development.

Contribution

Dedicated Group

Open Standards

Policy & process on
project contributions

Establish
OSPO

Participate in relevant
open standards

Guidelines &contribution training

Hire from open
source projects

Contribution
approval teamSupport & participate
in open source
foundations

Consider open sourcing
internal technology as
reference implementation

Increased participationin key open
source projects

FIGURE 13 illustrates the additional elements that the OSPO needs toimplement to support open source contributions.

Engage with Open Source Organizations
Open source foundations are a great resource to extend your impact
within the open source ecosystem. The best place to start is withfoundations that host initiatives that are relevant to your products
or technical interests. Many organizations find it worthwhile to get

Host open source events

involved with well-known, established foundations, such as The LinuxIT infrastructure to
support open
source development

Foundation’s TODO Group, the Mozilla Foundation, or the ApacheFoundation. If your organization is primarily concerned with legal
dynamics, getting involved with organizations such as the Software

Establish/recognize
open source
career paths

Freedom Law Center or the Open Invention Network will provevaluable. The primary goal is to identify the opportunities within theecosystem that your organization relies on. The OSPO is the entity

Support communities
of projects you
depend onthat drives these relationships based on the organization’s open
source strategy and product priorities.

Track Performance Metrics
Prioritize and Drive Upstream
Open Source Development

One of the more difficult tasks for an OSPO is decision-making on

One of the primary responsibilities of an OSPO is to improve the orga-

metrics, which are often used in product organizations, do not apply

key performance indicators or metrics that the office should track

nization’s engagement with the key open source projects that are usedin products and services. The first step is to identify where the organization relies on OSS by surveying all products and reviewing the SBOM.
The next step is to prioritize the OSS that is already in use and establish
a contribution strategy. Such a focused approach allows the OSPO to

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

22

to incentivize engineers toward the desired behavior. The traditionalin the context of open source development. Therefore, new metrics
are required. Many OSPOs use specialized tools to track their organization’s contributions to open source projects, analyze the type of contributions from their organization, identify contribution patterns, andprovide recommendations to improve the development impact.

IMPLEMENT INNERSOURCE PR ACTICES

A great method for OSPOs to expand theInnersource describes the process of applying the lessons that were

impact of open source is to foster internallearned from open source development methodology to internal projects.
The goal is to incubate the same values in the enterprise as those that arecollaboration using innersource practices.

common in the collaborative, open source development model.

These internal collaborations present incredible

A great method for OSPOs to expand the impact of open source is tovisibility opportunities for the OSPO with otherfoster internal collaboration using innersource practices. These internal
collaborations present incredible visibility opportunities for the OSPO

departments or teams within the organization.

with other departments or teams within the organization. In addition,such interactions and collaborations position the OSPO staff as theinternal experts on open source practices and create new opportunities
to collaborate with R&D and product teams.

OFFER ADVICE ON OPEN SOURCEGROW OPEN SOURCE TALENT INSIDE THE ORGANIZATION
One of the core responsibilities of an OSPO is to grow the open
source talent inside the organization. To do so, OSPOs can run various
programs, including workshops, training, mentoring, and internal evangelizing. Education is an essential building block in an OSPO, and it falls
into the following two categories: technical training to expand open
source technical knowledge and compliance training to ensure that theemployees possess a good understanding of the policies that govern theuse of OSS. The goal of this training is to raise awareness of open source
policies and strategies to build a common understanding of the issues
and facts of open source licensing and the business and legal risks ofincorporating OSS in products or software portfolios. The training also
serves as a venue to publicize and promote compliance policies andprocesses within the organization and foster a culture of compliance.
Moreover, OSPOs can create mentoring programs where senior
open source developers mentor junior developers, review their codecommits, provide feedback on code before it is submitted to the

OSPOs act as advisors on all matters related to OSS, whether they
are internal issues to the organization or external issues relating tocompliance, open source foundations, open standards, mergers andacquisitions, or other matters. Because of the importance of thisadvisory role, senior OSPO staff plays a critical role in shaping theirorganizations’ software strategy, as OSS is critical within the larger
software ecosystem.

MANAGE OPEN SOURCE IT INFR ASTRUCTURE
One of the OSPO’s challenges is to ensure that their organization
provides an IT infrastructure that allows open source developers tocommunicate and work with the open source projects with minimal
challenges. The following three primary domains of IT services arecommon in open source development:
1.

public websites.
2.

and influential in open source projects.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

Communication and problem-solving: mailing lists, forums, andreal-time chat.

upstream projects, and generally act as an advisor. The goal is to accelerate learning and support junior developers to become more effective

Knowledge sharing: wikis, collaborative editing platforms, and3.

Code development and distribution: code repositories andbug-tracking platforms.

23

Some or all of these tools will need to be available internally to effec-

Mergers and Acquisitions

tively support open source development. These open source practices

If an organization is considering a merger or is the target of an acqui-

typically require an IT infrastructure that is less restrictive than a typicalsition, the OSPO is a great source of expertise for open source

corporate environment. If this situation conflicts with existing orga-

technology and compliance due diligence. OSPOs can help their orga-

nization-wide IT policies, it is vital to resolve these conflicts and allow

nization to understand the open source code that is used by the target

open source developers to use the tools that are most familiar to them.

organization and its implications as part of the due diligence process.

It is worth noting that some OSPOs in large organizations create andmanage their own IT infrastructure independently from their corporate

Outsourced Development

IT departments.

The OSPO can also support corporate development when negotiating
the outsourced development of software, which will ensure that theproper compliance procedures are followed according to the organiza-

Saying “no” is unequivocally the author’s favorite OSPO responsibility.
OSPOs act as a gating function for all major contributions that leave theorganization, including new projects or contributing major proprietarytion’s policies and processes.

COLLABOR ATE WITH UNIVERSITIES ON
OPEN SOURCE PROJECTS

code. Saying “no” is the responsibility of OSPO leaders when

Many universities are eager to work with organizations that offer

proposals to release open source projects or contribute significant

world development experience. Often, this relationship is also bene-

bodies of code do not meet the proper requirements for success.

learning opportunities for their students and provide them with realficial to the organizations that are involved because it can be a great
way to develop new talent in existing open source communities andattract new development talent from a trusted source. This is particularly useful for projects that have a shortage of experienced devel-

ELIMINATE FRICTION FROM USING

opers and are typically more difficult to hire for. As the supply of

AND CONTRIBUTING TO OPEN SOURCE

talented programmers is limited, finding a way to tap into new

OSPOs help organizations navigate internal politics or policies,

knowledge and influence favorable outcomes in external projects,

maintain relationships with communities of strategic importance, andincluding academia, is vital.

continuously improve processes and tools to scale and reduce the

KNOW WHEN TO SAY “NO”

learning curve and manual effort that is required.

Saying “no” is unequivocally the author’s favorite OSPO responsibility.

SUPPORT CORPOR ATE DEVELOPMENT ACTIVITIESOSPOs act as a gating function for all major contributions that leave the

OSPOs should be involved with open source due diligence (technicalorganization, including new projects or contributing major proprietaryand compliance) as a part of corporate development. The two major
scenarios are merger and acquisition transactions and outsourced
development.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

24

code. Saying “no” is the responsibility of OSPO leaders when proposals
to release open source projects or contribute significant bodies of code
do not meet the proper requirements for success.

OSPOs and Eliminating Friction From
Using or Contributing to OSS
OSPOs face many challenges that we can group into the following

ask them to train other groups that are unfamiliar with the open source

five areas: culture, processes, tools, continuity, and education. FIGURE

development model. These experts can provide guidance to assist with

14 illustrates these challenge areas. The general goal of an OSPO is

the following:

to make it easy for the organization to use and contribute to OSS in
support of its business goals. As such, facing and resolving these challenges and possibly others that are unique to your organization will
help you achieve your goal.

• Create internal processes that follow the open source
development practices of release, doing so early and often,
and including peer reviews.
• Improve transparency between departments to encourage morecross-functional collaboration.

Culture• Form engineering teams around the ideals of meritocracy.

Cultural challenges often stem from the gap between traditional
software development practices and the requirements of open source
development. To bridge this gap, you can hire open source experts and

FIGURE 14

Challenges that
OSPOs face

• Establish proper success metrics to encourage open source andcross-department contributions.

CultureProcesses

Tools

Continuity

Education

Development model
Collaboration
Transparency
Meritocracy
Team formation
Hiring practices
Performance metrics

Governance
Usage
ComplianceContribution
Approvals
Operational model

IT infrastructure
Development tools
Tracking metrics
Knowledge sharing
Code reuse
Software composition
Analysis tool adoption

Strategy
Projects
Priorities
Funding
Executive support

Executive education
Knowledge transfer
Technical training
Compliance training
Mentorship program

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

25

Processes

TOOLS

Open source development is dynamic, moves very quickly, and has

The IT environment that you create should allow developers to join aunique requirements for compliance. Software-driven industries
will leave behind those organizations that do not adapt their internal
processes to support this type of development. As developers must beable to contribute code upstream quickly, the enterprise must modify
any internal code policies that hinder such development. We suggest
implementing the following to improve internal processes:• Put a team in charge of maintaining open source compliance to
avoid legal problems and set up a simple internal approval modelfor open source use and contributions.

team without requiring any significant changes to how they work. The
tools must support the open source development model, fulfill theneeds of the OSPO, and meet corporate IT guidelines. Open sourceengineers require flexibility to communicate with external participants
via email, chat, and code development platforms, and their IT tools
must facilitate this communication. For example, emails to an open
source project should never include attachments that claim the content
as the intellectual property of the email sender’s organization. We
suggest implementing the following changes for facilitating communication within your OSPO:• Move from highly complex and cumbersome policies to a morestraightforward approach for receiving, reviewing, and approving
source code contributions.
• Balance the interests of legal, engineering, and open source
and give the dedicated open source team blanket approval tocontribute to many open source projects.
• Use different levels of approval depending on the nature of thecode that is contributed (e.g., code to fix simple bugs, code to
improve existing functionality, code to affect new functionality,
or code to seed a new project).

• Allow communication with public mailing lists from organizationaccounts without obstruction.
• Give engineers devices that support the development distributionof their choice.
• Make sure that all open source developers can access all vitalinternal tools and resources on Linux or via a separate compatible
device.
• Support fully distributed teams that are working in remotelocations so that they can connect to internal business resources
through a virtual private network or similar technology.
• Evaluate your IT policies for help desk support, with secure
methods for resolving IT issues for remote employees.

The IT environment that you create should allow

Continuity

developers to join a team without requiring any significant

For some organizations, continuity suggests a long, boring documentchanges to how they work. The tools must support

lenge as the organization adapts to changes in its business, businessthe open source development model, fulfill the needsof the OSPO, and meet corporate IT guidelines.
A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

26

that nobody reads. When it comes to OSS, continuity is an ongoing chalstrategy, and industry. In practical terms, we can break continuity into
the following three categories:

1.

Continuity of the open source strategy. Informing current andfuture employees of the ever-evolving open source strategy, with
updates on new developments and changes in real time.

2.

COMPLIANCE TR AINING
With the adoption of OSS comes the responsibility to respect and fulfill
the IP obligations of applicable open source licenses. To that end, orga-

Continuity of projects and priorities. Ensuring continued

nizations provide employee training on the basics of OSS, open source

involvement in open source projects and initiatives to makelicenses, how copyright works, and the organization’s policies anduse of any momentum that preceded a period of disruption orprocesses.

changes in the organizational environment.
3.

Continuity of executive support and funding. Ensuring

MENTORSHIP PROGR AMS

continued financial and executive support and providing

To increase open source knowledge and technical skills, organizations

adequate resources to support the open source program.

set up mentoring programs in which a senior open source developer

The executive sponsor is critical to continuity and communicating

guides a junior developer in a structured and often one-to-one rela-

the value of the open source efforts and expectations acrosstionship. The goal is to transfer knowledge and train mentees on how tothe organization to encourage the successful adoption,

work effectively with open source projects while increasing their tech-

implementation, and contribution to open source projects.

nical competencies in their specific domain.

Education

TECHNICAL TR AINING

Open source software is an integral part of the software landscape,Technical training expands the technical knowledge base of staff. It

with significant benefits for users and the ecosystem. However, torealize these benefits, organizations must overcome knowledge deficits
through education and training as follows:tasks. The open source training industry is thriving because of the highdemand for open source skills and training on the latest open source
technologies.

EXECUTIVE TR AINING
These courses help executives and managers to understand and articulate the basic concepts for building effective open source practices.
Such courses often cover techniques for building effective processes
and strategies for consuming OSS, creating new open source projects,
contributing to projects, and driving software leadership in the open
ecosystem.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

addresses weaknesses and upskills employees to do new and different

27

The TODO GroupThe TODO Group is an OSPO resource hub and open community ofpractitioners who aim to create and share knowledge and collaborate
on practices, tools, and other ways to run successful and effective
OSPOs or similar open source initiatives. It was formed by its 1,700+
community participants and 80+ general members across different
sectors and regions and managed as an open source project under
The Linux Foundation. The TODO Group offers a maturity model, set ofConclusion
OSPOs play a critical role in helping organizations master OSS anddriving organizations into leadership positions in open technologies
that are critical to their products, services, and IT solutions. OSPOs can
support their organizations in the following four key areas:
1.

proper open source practices and incorporates open source

guides, mind map, 101 course, annual surveys, and case studies to help

policies, processes, checklists, and training.

organizations advance in their OSPO journey. These OSPO resources
are developed by the TODO Group in collaboration with The LinuxFoundation and the larger open source community. If you are looking

2.

and organizations that are important to the OSS that yourlooking to connect with peers at other organizations, please visit
OSPO forum discussions.

Participation — Engage with the open source community on
communication platforms and at events. Sponsor projects

to establish an OSPO in your organization, or you lead an OSPO and are
todogroup.org/community to get started and join our Slack channel orConsumption — Establish an internal infrastructure that enables

organization relies on for its products and services.
3.

Contribution — Hire or train developers that focus specificallyon open source contributions and deploy the necessary tools to
support internal open source engineering.

4.

Leadership — Increase engagement with open source
communities, open standards bodies, and open source
foundations; launch new open source initiatives and projects;
and increase your organization’s visibility in open source
communities.

If you are part of an organization that relies on OSS for products orservices and your organization does not have a formalized OSPO yet,please consider this report a call to action to do exactly that.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

28

Acknowledgments

Feedback

The author would like to express his sincere appreciation to his LinuxThe author apologizes in advance for any spelling mistakes or possible

Foundation and TODO Group colleagues, Chris Aniszczyk, Hilary Carter,

errors and is grateful to receive corrections and suggestions for

Ana Jimenez, Jason Perlow, Melissa Schmidt, and Barry Hall, for theirimprovements via ibrahimatlinux.com/contact.html.

valuable reviews and feedback. This report has benefited immenselyfrom their experiences and contributions.

Linux Foundation Resources• E-book: Guide to Enterprise Open Source• E-book: Open Source Compliance in the Enterprise• E-book: Open Source Audits in Merger and Acquisition
Transactions• Linux Foundation Enterprise Guides• Linux Foundation Open Compliance Program — Resources tosupport organizations with open source compliance.
• TODO Group — Open community of practitioners andorganizations that collaborate on best practices, tools, and otherways to run successful open source programs.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

29

About the Author
Dr. Ibrahim Haddad is Vice President of Strategic Programs at The Linux Foundation and theGeneral Manager of LF AI & Data, which provides a trusted hub for developers to code, manage,
and scale critical open source artificial intelligence and data projects. Before The Linux Foundation,
he served as Vice President of R&D and Head of the Open Source Division at Samsung Electronics.
Throughout his career, Haddad held technology and portfolio management roles at Ericsson
Research, the Open Source Development Labs, Motorola, Palm, Hewlett-Packard, and The LinuxFoundation. He graduated with honors from Concordia University (Montréal, Canada) with a Ph.D.
in Computer Science. ​Twitter: @IbrahimAtLinux
Website: IbrahimAtLinux.com

Disclaimer
This report is provided “as is.” The Linux Foundation and its authors, contributors, and sponsors expressly disclaim any
warranties (express, implied, or otherwise), including implied warranties of merchantability, noninfringement, fitness for aparticular purpose, or title, related to this report. In no event will The Linux Foundation and its authors, contributors, andsponsors be liable to any other party for lost profits or any form of indirect, special, incidental, or consequential damages ofany character from any causes of action of any kind with respect to this report, whether based on breach of contract, tort(including negligence), or otherwise, and whether they have been advised of the possibility of such damage. Sponsorship ofthe creation of this report does not constitute an endorsement of its findings by any of its sponsors.

A DEEP DIVE INTO OPEN SOURCE PROGRAM OFFICES: STRUCTURE, ROLES, RESPONSIBILITIES, AND CHALLENGES

30

Part of The Linux Foundation, LF AI & Data supports open source innovation in artificial intelligence,
Founded in 2021, Linux Foundation Researchmachine learning, deep learning, and data. LF AI & Data was established to support a sustainable open

explores the growing scale of open source

source AI ecosystem that makes it easy to create AI and data products and services using open source

collaboration, providing insight into emerging

technologies. We foster collaboration under a neutral environment with an open governance model totechnology trends, best practices, and the

support the harmonization and acceleration of open source technical projects.

global impact of open source projects. Throughleveraging project databases and networks, anda commitment to best practices in quantitativeand qualitative methodologies, Linux Foundation
Research is creating the go-to repository for open
source insights for the benefit of organizations theworld over.

TODO is an open group of 70+ organizations with years of experience running open source programs thatwant to collaborate on practices, tools, and other ways to run successful and effective open source projects
and programs. It is a place to share experiences, develop best practices and guidance as well as work on
common tooling to improve OSPO adoption and education worldwide across sectors. Discover more about
all the ongoing TODO Initiatives here and check out the OSPO landscape: https://landscape.todogroup.org

twitter.com/linuxfoundation
facebook.com/TheLinuxFoundation

twitter.com/todogroup

facebook.com/todo

linkedin.com/company/todo-grouplinkedin.com/company/the-linux-foundation
youtube.com/user/TheLinuxFoundation

Copyright © 2022 The Linux Foundation

This report is licensed under the Creative Commons Attribution-NoDerivatives 4.0 International Public License.
This material may be copied and distributed under the terms of the Creative Commons license.
To reference the work, please cite as follows: Ibrahim Haddad, “A Deep Dive Into Open Source Program Offices:
Structure, Roles, Responsibilities, and Challenges “ foreword by Chris Aniszczyk, August, 2022.

31