<!-- Completed by AEOESS for the Agent Passport System project, 2026-07-10.
Every statement verified against docs/OPEN-SOURCE-POLICY.md,
docs/SECURITY-ASSURANCE-PROGRAM.md, SECURITY.md, and repository controls.
Source checklist: OpenChain Reference-Material (CC0). Standard: ISO/IEC 5230:2020. -->

![](./media/image1.png "OpenChain logo")

# OpenChain ISO/IEC 5230 Self-Certification Checklist
## The Simple Way To Check Conformance

Generation 2 - Version 1
2025-08-18

# Introduction

OpenChain ISO/IEC 5230 is the International Standard for open source license compliance. ISO/IEC 5230 helps organizations manage open source licensing requirements for past, current and future products or services.

Your organization can self-certify to conform to OpenChain ISO/IEC 5230. It is as simple as answering “yes” to all the questions on the online form. If an organization cannot answer “yes” to all of the questions, it does not yet meet the requirements of the standard.

Please note that this is a self-certification, and you and your organization are solely responsible for the accuracy of the statements below.

You also have the option of filling out this checklist online:
[https://openchainproject.org/checklist-iso-5230-2020](https://openchainproject.org/checklist-iso-5230-2020)

# The Self-Certification Checklist

## Section 1: Program foundation

- [x]  We have a documented policy governing the open source license compliance of supplied software.

- [x]  We have a documented procedure to communicate the existence of the open source policy to program participants.

- [x]  We have identified the roles and responsibilities that affect the performance and effectiveness of the program.

- [x]  We have identified and documented the competencies required for each role.

- [x]  We have documented the assessed competence for each program participant.

- [x]  We have documented the awareness of our program participants on the open source policy and where to find it.

- [x]  We have documented the awareness of our program participants on relevant open source objectives.

- [x]  We have documented the awareness of our program participants on contributions expected to ensure the effectiveness of the program.

- [x]  We have documented the awareness of our program participants on the implications of failing to follow the Program requirements.

- [x]  We have a process for determining the scope of our program.

- [x]  We have a written statement clearly defining the scope and limits of the program.

- [x]  We have a documented procedure to review and document open source license obligations, restrictions and rights.

## Section 2: Relevant tasks defined and supported

- [x] We have a publicly visible method for any third party to make an open source license compliance inquiry (e.g. via a published contact email address).

- [x] We have a documented procedure for responding to open source compliance inquiries.

- [x] We have documented the persons, group or function supporting the program role(s) identified.

- [x] We have ensured the identified program roles been properly staffed and adequately funded.

- [x] We have identified legal expertise to address internal and external open source compliance matters.

- [x] We have a documented procedure assigning internal responsibilities for open source compliance.

- [x] We have a documented procedure for handling the review and remediation of non-compliant cases.

## Section 3: Open source content review and approval

- [x]  We have a documented procedure for identifying, tracking, reviewing, approving, and archiving information about the open source components in a supplied software release.

- [x]  We have open source component records for the supplied software to demonstrate the documented procedure was properly followed.

- [x]  We have a documented procedure that covers distribution of the supplied software in binary form.

- [x]  We have a documented procedure that covers distribution of the supplied software in source form.

- [x]  We have a documented procedure that covers integration of the supplied software with open source that may trigger additional obligations.

- [x]  We have a documented procedure that covers inclusion of modified open source in the supplied software.

- [x]  We have a documented procedure that covers inclusion of open source or other software under incompatible licenses interacting with other components in the supplied software.

- [x]  We have a documented procedure that covers inclusion of open source with attribution requirements in the supplied software.

## Section 4: Compliance artifact creation and delivery

- [x] We have a documented procedure describing the process for preparing and distributing compliance artifacts with the supplied software as required by the identified licenses.

- [x] We have a documented procedure for archiving copies of compliance artifacts for the supplied software from either the last offer of the supplied software or as required by the identified licenses, whichever is longer.

## Section 5: Understanding open source community engagements

- [x] We have a documented open source contribution policy.

- [x] We have a documented procedure governing open source contributions.

- [x] We have a documented procedure for making all program participants aware of the open source contribution policy.

## Section 6: Adherence to the specification requirements

- [x]  We have documentation confirming that the program meets all the requirements of the specification.

- [x]  We have documentation confirming that the program conformance is reviewed at least every 18 months.

# Next Steps

Have you self-certified to this specification? You can let us know at this link:
[https://openchainproject.org/conformance-submission](https://openchainproject.org/conformance-submission)

We would love to add your organization to our Community of Conformance list on the OpenChain Project website. This is optional, but it is a great way to encourage adoption across the supply chain.