Leaders
WhoGrant
OngersEmail-date Member?

27-July Yes

Comment

I'd like to modify the wording on:

Current Text

Suggested
Text

Status(Accepted /Rejected /Modified /Duplicate)
Accepted"Administer fair and open elections as often as once every 24 months for Leadership rolesin their group."
to be:"Manage leadership appointments and changes in accordance with the relevant
guidelines."
And to add the following text under the heading Leadership:"In the case of Chapter, Committee, or group leadership, OWASP follows an elective
representative approach; so fair and open elections for the leadership roles in these cases
are required at least every 24 months to ensure that the leadership of those entities dorepresent the will of those communities.
In the case of Project leadership, OWASP follows other open source initiatives in allowing
project leadership to remain with the project initiator (or their successor, through whateverinternal process) and to allow the forking of projects and then the relative popularity of theforks to determine dominance. A project that forks from an existing OWASP project canmake an application to become a new OWASP project and potentially to even replace theoriginal should that be in the best interest of the Foundation."
Christian
Folini27-July Yes

Looking over the "Leaders (Draft WIP)", I get the feeling the policy
interferes too much with the running of chapters, but even more projects.

Accepted

Treating all the projects alike and forcing the same rules on all projects ishaving a negative impact on many projects that face unique situations thatcan not be addresses by out of the box solutions.
Enforcing leadership elections in projects is such an example or forcing
projects to work with OWASP mailinglists is another one. While I see thepositive idea behind it, this is just not working for all projects. Some
projects will simply prefer slack and while I think they ought to be
doing business via mailinglists, it should not be enforced.
-> Give the projects more freedom to develop, don't interefere so much.
I also see significant redundancy with the new donations policy. A linkto said policy should be enough.
Disputes: I like the idea of an escalation ladder. But having HQ staff
interfere with problems with project leaders, especially elected projectleaders, is a troubling thought. OWASP staff is not elected and can not
be contested the way an elected committee and ultimately the board ofdirectors can.
RickMitchell

4-Aug Yes

> Leaders serve at the pleasure of the OWASP Board and the larger AppSec Community.

Accepted

Why start this off adversarially? Making this statement as such only serves to sow
disharmony. Projects are Open Source and are highly likely to simply leave theorganization were the board to attempt to unilaterally remove a leader. I'd suggest:"Leaders serve at the pleasure of the larger AppSec Community"
RickMitchell

4-Aug Yes

> Document proceedings of the group on the OWASP Foundation supplied Mail List

Accepted

This is a policy document it shouldn't attempt to define working models/mechanisms. While
it's nice to promote use of org resources/solutions requiring their use without other options
simply limits the effectiveness of the document, what happens in 3 years when Google
groups goes away? Then you're bound to find a mailing list replacement or update thisdocument again as it's overly prescriptive. Additionally what about projects/regions thatdislike this mechanism. I'd suggest something more generic:"Document proceedings in an open manner or make them available upon request."
RickMitchell

4-Aug Yes

> Protect participant data and ensure GDPR Compliance in proceedings

Accepted

What does this mean? I"m not a European citizen and have no insight into GDPR
requirements (which is likely true of numerous chapter/project leaders). Does the org havea consultant available to ensure this is happening and provide guidance tochapters/projects? (The Org as a whole). Obviously participant data should be protected,however making reference to particular compliance requirements without a plan to actuallydeal with such seems like a mistake. I'd suggest simplifying as follows:"Take reasonable steps to protect participant data in any proceedings or participation
related to OWASP projects or activities"
RickMitchell

4-Aug Yes

> Annually sign a Leaders Agreement that includes these Core Principles
Where is this? What's the mechanism to tracking/maintaining these? How are we supposed
to approve this policy with the reference to this doc if it doesn't exist? I'd suggest justremoving this. It's more administrative overhead that the org doesn't need.

10/27/2020

It is posted

Leaders
WhoRickMitchell

Email-date Member?

Comment4-Aug Yes> Injure or impugn the reputation the Foundation, colleagues, staff, or Directors on social
media

Current Text

Suggested
Text

Status(Accepted /Rejected /Modified /Duplicate)
Accepted

Why is this limited to "social media"? I'd suggest simply dropping the "on social media"
portion, it shouldn't happen at all.

RickMitchell

4-Aug Yes

> Authorize expenses that are in violation of OWASP Foundation polocy

Accepted"polocy" => "policy" maybe even "policy(ies)"

RickMitchell

4-Aug Yes

Rejected> If the Foundation Staff or Board of Directors determines that a Leader has not compliedwith these rules, their status as a Leader may be revoked.
Sure, however in the case of projects this likely just leads to forking or leaving the org. (Forchapters it likely means the chapter just disappears quietly into the night.) I understandthere has to be some recourse but the org needs to be aware of what this means or how it
could turn out.

RickMitchell

4-Aug Yes

> however groups must abide by the Code of Conduct, Foundation bylaws, and the polices
in these Rules of Procedure.

Accepted

This document/section isn't "Rules of Procedure".... I'd suggest:" however groups must abide by the Code of Conduct, Foundation bylaws, and thepolices."
Rick
Mitchell

4-Aug Yes

> Be responsive to all requests generally within 5-7 business days.

AcceptedStaff don't even hit this SLA. It seems ridiculous to try to set an SLA for volunteers when
paid staff can't even hit the SLA. Also this suggests that "leaders" must be responsive,
however some projects/chapters are too big for that. I'd suggest simply removing this bullet.

RickMitchell

4-Aug Yes

> Commit to serve for a minimum term of 24 months.

Accepted

Or what? While consistency is important this simply serves to limit and discourage
participation. These are volunteers, who knows what life changes might occur in a 24month period. This should be removed or made more volunteer friendly:"Commit to serve as long as possible. Up to 24months for elected positions."(More on that below.)
RickMitchell

4-Aug Yes

> Administer fair and open elections as often as once every 24 months for Leadership rolesin their group.

Accepted

This isn't applicable for projects, and many chapters as well. For my local chapter there's acore group of volunteers that decides, there's an open planning meeting once a year.
Leaders are invited to volunteer and there are never "too many". I have no idea how we'deven hold an election. I guess we could ask at a chapter meeting if people were okay withthe choice/option but given that there are thus far never any alternatives that seems kind ofpointless. Plus again this simply adds administrative overhead to the org/staff that alreadyhas trouble delivering and being responsive. Who is going to track the 24 months for 1000sof projects/chapters? Who is going to setup the system/process for each election?
(Expecting the projects/chapters to do this doesn't seem practical, we can barely get them
all updating the website.) Also it seems likely that the "voting" would be limited to members,
but projects/chapters have no mechanism by which to check membership, so there's
another staff task....
RickMitchell

4-Aug Yes

> When their are violations, please follow the following hierarchy when escalating
concerns:

Accepted"their" => "there"

Rick
Mitchell

4-Aug Yes

> Leaders will be provided an Owasp.org email account and shall this address for all
OWASP related matters.
I think you want "and shall use this". While it's good to promote consistency, who is going
to police/enforce this. Seems like yet another task the org can't and doesn't need to handle.
Stating that leader email addresses are listed on the site should suffice to make themreachable. (However again, I'll ask who is going to police/enforce that.)

10/27/2020

AcceptedLeaders
WhoRickMitchell

Email-date Member?

Comment4-Aug Yes> Social Media accounts associated with OWASP Projects, Chapters, or groups arecontrolled by the OWASP Foundation. While the Leader, or in rare cases members, may
create an account and manage its day-to-day operations, credentials including passwords
and recovery emails must be transferred when there is a change of leadership.

Current Text

SuggestedText

Status(Accepted /Rejected /Modified /Duplicate)
Accepted

It makes sense for these to be transferred when/if necessary, however the oversight orcontrol seems like yet another thing the org/staff can't and shouldn't have to handle. I'dsuggest a rewrite:"While the Leader, or in rare cases members may create Social Media accounts associatedwith OWASP Projects, Chapters, or groups and manage their day-to-day operations,credentials including passwords and recovery emails/numbers must be transferred when
there is a change of leadership"
RickMitchell

4-Aug Yes

> In either case, custom domain names shall point to the corresponding page on theFoundation website for the group, and if maintained by a Leader, its use shall be registeredwith the Foundation.

Accepted

This needs to be clarified. What does "shall point" mean? That they're simply used for
redirection? (That's not practical, GH pages doesn't provide the flexibility that some projects
need.) Does it simply mean a link back to owasp.org? (Which seems reasonable, alongwith appropriate copyright/trademark markings etc). Either way it needs a rewrite of somesort.
Rick
Mitchell

4-Aug Yes> Leaders shall host group meetings no less than four times a year. Chapter Meetings must
be in-person.

AcceptedAgain while regular meetings are a good goal, this seems like a ridiculous thing for the org
to try to police/enforce. What if a volunteer can only manage 3 in a year? Also given the on
going global health crisis trying to enforce "in-person" chapter meetings seems like amistake.

RickMitchell

4-Aug Yes

> This includes but not limited to the OWASP Mailing Lists

Accepted"This includes but is not limited to the OWASP Mailing Lists"RickMitchell

4-Aug Yes

> The minimual acceptable channels for this posting is the group’s main webpage on
owasp.org and the OWASP Mailing List (Google Groups), or in the case of Chapter theOWASP Mailing List can be replaced with an OWASP Meetup account.

Accepted

This seems too prescriptive, outlining the specific technologies/platforms to be used may
bottleneck or invalidate the policy in the future. Also there's a typo "minimual". I'd suggest are-write:"At a minimum meetings should be announced via two public communication mechanisms
known to be regularly used by the project/chapter/group."

RickMitchell

4-Aug Yes

> Section 5:

Accepted

There are numerous policy/documentation references prior to this point however they aren't
linked/cross referenced until this section where donations etc are linked. I'd suggest that
more linking is a good thing. While it's a maintenance headache (potentially) it makes
things much more usable and user-friendly.
RickMitchell

4-Aug Yes

> General

Accepted

Bulleted lists within the doc don't seem to consistently use (or not use) periods.
Lisa Jones

10-Sep YesLeadership* Leader should contact the Foundation immediately if need to step down as leader.
* Minimum of 2 Leaders per chapter - Chapters with 1 leader are not meeting the minimum
criteria for an active chapter. Two leaders are required for the expense approval process.
OWASP.org Email Accounts
Leaders will be provided an Owasp.org email account and shall monitor regularly for
information from the he Foundation. The email address of Leaders will be listed on theOWASP website. By using the OWASP email address, Leaders ensure vendor neutrality,
protect their own privacy, and allow for identity portability within the OWASP community.

Accepted

Lisa Jones

10-Sep Yes

A group’s webpage shall minimally include:

AcceptedGroup leadership with contact information
Link to the group’s Mailing List (Google Group)
Meetings Notices (For Chapters 2 weeks prior)Website
Chapters and Projects reposting and rewording of certain policies has been a problem. ie.
donation I suggest that leaders are instructed not to re- post policies that are associatedwith financial matters because of the regulations the Foundation is held to by the IRS for
non-profit 501c 3. The Foundation will only review and update the policy page on owasp.
org and leaders would need to review that page on a constant bases and update theirindividual chapter page to be compliant with the regulations. As we have seen getting
leaders to update owasp.org chapter pages does not occur on a regular bases.

10/27/2020

Leaders
WhoEmail-date Member?

CommentLisa Jones

10-Sep Yes

Social MediaThe below statement as far as I am aware is not happening. This is an area that does
needs to be addressed. There have been cases where chapters use other social media
accounts to fun their chapter outside the knowledge of the Foundation. Even when they
have been made inactive.
Social Media accounts associated with OWASP Projects, Chapters, or groups arecontrolled by the OWASP Foundation. While the Leader, or in rare cases members, may
create an account and manage its day-to-day operations, credentials including passwords
and recovery emails must be transferred when there is a change of leadership.

Lisa Jones

10-Sep Yes

Current Text

Suggested
Text

Status(Accepted /Rejected /Modified /Duplicate)
Duplicate

Rejected
Domain Names
Is there a list of current list of chapter and project domains in place today? Who ismanaging an enforcing? Are we or do we pay for domains? I would think that this willneed to addressed especially since OWASP now is a registered trademark.
More important how is the Foundation going to handle the projects that have their own
separate websites?

Lisa Jones

10-Sep Yes

Meetings
Chapter Meetings must be in-person. In person, Virtual or OWASP chapter run event werealways acceptable ways to meet the criteria of 4 meetings a year. (Preferably a calendar
year, spread apart)

Accepted

Lisa Jones

10-Sep Yes

Section 5 should be removed and leaders should be held accountable for the Policies andProcedures listed on the owasp.org website.

Reject. Will
include here too

MaethaWadee

24-July No<empty>Rejected

MaethaWadee

24-July No<empty>Rejected

Ms. Lynn
Wilderson

26-July No<empty>Rejected

Josh Sokol

27-July No

I respectfully disagree on the elective approach for Chapters. This has been discouraged
in the Chapter Handbook for over a decade:

Rejected

https://owasp.org/www-policy/operational/chapter-handbook-existingJosh Sokol

27-July No

My suggestion is to not adopt a new policy on this and continue to leverage the handbooks
that were designed to address these issues that are specific to those entities:

Rejected

https://owasp.org/www-policy/operational/chapters
https://owasp.org/www-policy/guidebook/chapter-leader
Nargiza

30-July No<empty>Rejected

JVennyFirdaus2-Aug No<empty>Rejected

Big Daddy

3-Aug No<empty>RejectedThai My Luc

5-Aug No<empty>RejectedDavidJuarez
Mena

15-Aug No<empty>Rejected

Robby
Ramon

24-Aug No<empty>Rejected

Asil Kadro

10-Sept

No<empty>Rejected

MarcusBock

16-Sept

No<empty>Rejected

10/27/2020