questionnaire.json

{
  "specVersion": "2.1.1",
  "language": "en",
  "title": "Conformance in Questions",
  "contextText": "Context",
  "questionsText": "Questions",
  "completedText": "Completed?",
  "statusText": "Status",
  "answerColumnText": "Answer",
  "sectionColumnText": "Section",
  "numberColumnText": "Number",
  "specRefColumnText": "Spec Ref",
  "questionColumnText": "Question Text",
  "tocText": "Table of Contents",
  "preambleText": "The OpenChain Project builds trust in open source by making license compliance simpler and more consistent. It maintains the OpenChain Specification to define a core set of requirements every quality compliance program must satisfy. The result is that open source license compliance becomes more predictable, understandable and efficient for participants of the software supply chain.\nThis document contains a series of questions to determine whether a company has an OpenChain Conformant program. If each of these questions can be answered with a \"yes\" then that company meets all the requirements of conformance to the OpenChain Specification version 2.1 (functionally identical to ISO/IEC DIS 5230:2020(e)). If any of the questions are answered with a \"no\" then the company can clearly identify where additional investment is needed to improve the compliance process.",
  "sections": [
    {
      "name": "Part 1",
      "title": "1. Program foundation",
      "questions": [
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented policy governing the open source license compliance of the Supplied Software?",
          "number": "1.a",
          "type": "YES_NO",
          "specReference": [
            "1.1",
            "1.1.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure to communicate the existence of the open source policy to all Software Staff",
          "number": "1.b",
          "type": "YES_NO",
          "specReference": [
            "1.1",
            "1.1.2"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Have you identified the roles and responsibilities that affect the performance and effectiveness of the Program?",
          "number": "1.c",
          "type": "YES_NO",
          "specReference": [
            "1.2",
            "1.2.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Have you identified and documented the competencies required for each role?",
          "number": "1.d",
          "type": "YES_NO",
          "specReference": [
            "1.2",
            "1.2.2"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Have you documented the assessed competence for each Program participant?",
          "number": "1.e",
          "type": "YES_NO",
          "specReference": [
            "1.2",
            "1.2.3"
          ]
        },
        {
          "question": "Have you documented the awareness of your Program participants on the following topics?",
          "number": "1.f",
          "type": "SUBQUESTIONS",
          "specReference": [
            "1.3",
            "1.3.1"
          ],
          "minNumberValidatedAnswers": 4,
          "subQuestions": {
            "1.f.i": {
              "correctAnswer": "Yes",
              "question": "The open source policy and where to find it;",
              "number": "1.f.i",
              "type": "YES_NO",
              "specReference": [
                "1.3"
              ]
            },
            "1.f.ii": {
              "correctAnswer": "Yes",
              "question": "Relevant open source objectives;",
              "number": "1.f.ii",
              "type": "YES_NO",
              "specReference": [
                "1.3"
              ]
            },
            "1.f.iii": {
              "correctAnswer": "Yes",
              "question": "Contributions expected to ensure the effectiveness of the Program;",
              "number": "1.f.iii",
              "type": "YES_NO",
              "specReference": [
                "1.3"
              ]
            },
            "1.f.iv": {
              "correctAnswer": "Yes",
              "question": "The implications of failing to follow the Program requirements.",
              "number": "1.f.iv",
              "type": "YES_NO",
              "specReference": [
                "1.3"
              ]
            }
          }
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a process for determining the scope of your Program?",
          "number": "1.g",
          "type": "YES_NO",
          "specReference": [
            "1.4",
            "1.4.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a written statement clearly defining the scope and limits of the Program?",
          "number": "1.h",
          "type": "YES_NO",
          "specReference": [
            "1.4",
            "1.4.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure to review and document open source license obligations, restrictions and rights?",
          "number": "1.i",
          "type": "YES_NO",
          "specReference": [
            "1.5",
            "1.5.1"
          ]
        }
      ]
    },
	{
      "name": "Part 2",
      "title": "2. Relevant tasks defined and supported",
      "questions": [
        {
          "correctAnswer": "Yes",
          "question": "Have you assigned individual(s) responsibility for receiving external open source compliance inquiries?",
          "number": "2.a",
          "type": "YES_NO",
          "specReference": [
            "2.1",
            "2.2.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Is the external open source compliance contact publicly identified (e.g. via an email address or the Linux Foundation Open Compliance Directory)?",
          "number": "2.b",
          "type": "YES_NO",
          "specReference": [
            "2.1",
            "2.1.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure for receiving and responding to open source compliance inquiries?",
          "number": "2.c",
          "type": "YES_NO",
          "specReference": [
            "2.1",
            "2.1.2"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Have you documented the persons, group or function supporting the Program role(s) identified?",
          "number": "2.d",
          "type": "YES_NO",
          "specReference": [
            "2.1",
            "2.2.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Have the identified Program roles been properly staffed and adequately funded?",
          "number": "2.e",
          "type": "YES_NO",
          "specReference": [
            "2.1",
            "2.2.2"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Has legal expertise to address internal and external open source compliance been identified?",
          "number": "2.f",
          "type": "YES_NO",
          "specReference": [
            "2.1",
            "2.2.3"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure assigning internal responsibilities for open source compliance?",
          "number": "2.g",
          "type": "YES_NO",
          "specReference": [
            "2.1",
            "2.2.4"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure for handling review and remediation of non-compliant cases?",
          "number": "2.h",
          "type": "YES_NO",
          "specReference": [
            "2.1",
            "2.2.5"
          ]
        }
      ]
    },
    {
      "name": "Part 3",
      "title": "3 Open source content review and approval",
      "questions": [
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure for identifying, tracking and archiving information about the open source components in a Supplied Software release?",
          "number": "3.a",
          "type": "YES_NO",
          "specReference": [
            "3.1",
            "3.1.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have open source component records for the Supplied Software which demonstrate the documented procedure was properly followed?",
          "number": "3.b",
          "type": "YES_NO",
          "specReference": [
            "3.1",
            "3.1.2"
          ]
        },
        {
		  "question": "Do you have a documented procedure that covers these common open source license use cases for open source components in the Supplied Software?",
          "number": "3.c",
          "type": "SUBQUESTIONS",
          "specReference": [
            "3.2",
            "3.2.1"
          ],
          "minNumberValidatedAnswers": 6,
          "subQuestions": {
            "3.c.i": {
              "correctAnswer": "Yes",
              "question": "     Distribution in binary form;",
              "number": "3.c.i",
              "type": "YES_NO",
              "specReference": [
                "3.2",
            	"3.2.1"
              ]
            },
            "3.c.ii": {
              "correctAnswer": "Yes",
              "question": "     Distribution in source form;",
              "number": "3.c.ii",
              "type": "YES_NO",
              "specReference": [
                "3.2",
            	"3.2.1"
              ]
            },
            "3.c.iii": {
              "correctAnswer": "Yes",
              "question": "     Integration with other open source that may trigger additional obligations;",
              "number": "3.c.iii",
              "type": "YES_NO",
              "specReference": [
                "3.2",
            	"3.2.1"
              ]
            },
            "3.c.iv": {
              "correctAnswer": "Yes",
              "question": "     Containing modified open source;",
              "number": "3.c.iv",
              "type": "YES_NO",
              "specReference": [
                "3.2",
            	"3.2.1"
              ]
            },
            "3.c.v": {
              "correctAnswer": "Yes",
              "question": "     Containing open source or other software under incompatible licenses for interaction with other components in the Supplied Software;",
              "number": "3.c.v",
              "type": "YES_NO",
              "specReference": [
                "3.2",
            	"3.2.1"
              ]
            },
            "3.c.vi": {
              "correctAnswer": "Yes",
              "question": "     Containing open source with attribution requirements.",
              "number": "3.c.vi",
              "type": "YES_NO",
              "specReference": [
                "3.2",
            	"3.2.1"
              ]
            }
          }
        }
      ]
    },
    {
      "name": "Part 4",
      "title": "4. Compliance artifact creation and delivery",
      "questions": [
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure describing the process for ensuring the Compliance Artifacts are distributed with Supplied Software as required by the Identified Licenses?",
          "number": "4.a",
          "type": "YES_NO",
          "specReference": [
            "4.1",
            "4.1.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure for archiving copies of Compliance Artifacts for the Supplied Software?",
          "number": "4.b",
          "type": "YES_NO",
          "specReference": [
            "4.1",
            "4.1.2"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Are the Compliance Artifacts archived at least as long as the Supplied Software is offered and as required by the Identified Licenses?",
          "number": "4.c",
          "type": "YES_NO",
          "specReference": [
            "4.1",
            "4.1.2"
          ]
        }
      ]
    },
    {
      "name": "Part 5",
      "title": "5. Understanding open source community engagements",
      "questions": [
        {
          "correctAnswer": "Yes",
          "question": "Do you have a policy for contribution to open source projects on behalf of the organization?",
          "number": "5.a",
          "type": "YES_NO",
          "specReference": [
            "5.1",
            "5.1.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure governing open source contributions?",
          "number": "5.b",
          "type": "YES_NO",
          "specReference": [
            "5.1",
            "5.1.2"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have a documented procedure for making all Software Staff aware of the open source contribution policy?",
          "number": "5.c",
          "type": "YES_NO",
          "specReference": [
            "5.1",
            "5.1.3"
          ]
        }
      ]
    },
    {
      "name": "Part 6",
      "title": "6. Adherence to the specification requirements",
      "questions": [
        {
          "correctAnswer": "Yes",
          "question": "Do you have documentation confirming that your Program meets all the requirements of this specification?",
          "number": "6.a",
          "type": "YES_NO",
          "specReference": [
            "6.1",
            "6.1.1"
          ]
        },
        {
          "correctAnswer": "Yes",
          "question": "Do you have documentation confirming that your Program conformance was reviewed within the last 18 months?",
          "number": "6.b",
          "type": "YES_NO",
          "specReference": [
            "6.2",
            "6.2.1"
          ]
        }
      ]
    }
  ]
}