1、The Business Value of the OSPOAn Exploration of Why Organizations Create,Sustain,and Expand Open Source Program Offices(OSPOs)MARCH 2023Emily Omier,Positioning&Messaging Consultant,Emily Omier Consulting Chris Aniszczyk,CTO,Cloud Native Computing FoundationAna Jimnez Santamara,OSPO Program Manager,T

2、ODO GroupWith forewords by Georg Kunz,Open Source Manager,Ericsson,Leslie Hawthorn,Sr.Manager,Red Hat OSPO and Kimberly Craven,Sr.Director,Red Hat OSPO,Office of the CTOIn partnership with:ContentsForewords.3Introduction.7Why do we care about how OSPOs contribute to the business?.7Common threads in

3、unique stories.7Methodology.8Organization profiles and the relationship with open source.8What can OSPOs do for organizations?.11The reasons behind starting an OSPO.11The OSPO journey.16Overcoming internal obstacles:Culture and education.16A strategic relationship with open source.17The different ha

4、ts of an OSPO .18The Counselor.18The Facilitator.18Ensuring OSPO sustainability.18Measuring an OSPOs success.19Common OSPO KPIs.19The KPI search.20Conclusion.21Whats coming in the future?.21Future research.21About the authors.223THE BUSINESS VALUE OF THE OSPOForewordsOpen source software continues t

5、o transform how entire industries create and use software.Across industries,systems built to a large degree or even entirely from open source software components that communicate via open APIs are replacing proprietary and closed software stacks.Based on collaboration and joint development,open sour

6、ce software has become a fundamental means for driving innovation,fostering technology adoption,and openly sharing knowledge.While the high-level advantages of open source software are undeniable,it is unfortunately far from simple and straightforward for organizations to leverage those in practice.

7、As the usage of open source software in organizations proliferates and matures,many realize the need for establishing a structured approach to working with open source software.Initially,this need typically emerges from license compliance concerns,but it quickly grows way beyond compliance alone,eve

8、ntually encompassing business strategy aspects as well.This report compiles the results of a survey among open source advocates from Open Source Program Offices(OSPOs)across various companies and universities.It provides a broad insight into the motivation behind forming OSPOs and the concrete busin

9、ess value of OSPOs to their respective organizations.It turns out that,just like open source software itself,OSPOs come in all sorts of shapes and forms.However,irrespective of the concrete implementation of an OSPO,the survey shows that across organizations,the key business value of OSPOs converges

10、 toward the same fundamental goals:to establish a framework for an organizations way of working with open source software and to ensure that open source software is leveraged strategically and well aligned with an organizations business goals.An OSPOs responsibilities thereby range from formalizing

11、processes and transforming an organizations culture to guiding the creation and execution of a long-term open source strategy.Building on the core principles of open source softwarecollaboration and knowledge sharingthe contributors to this report aim to provide a helpful source of information.It ta

12、rgets both open source champions in organizations who are currently on the journey of establishing an OSPO as well as open source leaders of existing OSPOs,enabling them to clearly define,measure,and communicate the business value of an OSPO.Georg KunzOpen Source Manager,Ericsson 4THE BUSINESS VALUE

13、 OF THE OSPOAs open source software has achieved ubiquity in the technology arena,more organizations are realizing the benefits of working with open source projects and the communities that build them.To harness this strategic potential of open source,direct investment into engaging with project com

14、munities is no longer a nice to have but a requirement.OSPOs,once largely extant only at large technology-focused firms,have proliferated across industries as a locus for starting,standardizing,and scaling an organizations approach to open source.In just the past five years,we have seen OSPOs crop u

15、p in the fields of automotive,entertainment,financial services,manufacturing,and even within academia and government bodies.Having an OSPO and accompanying dedicated resources to focus a companys open source strategy creates a framework for harnessing the best possible outcomes for all players invol

16、ved.Organizations have a clearer view of the software landscape upon which their businesses depend,maintainers of key software projects have a more direct line into organizations using their works,and external would-be collaborators have a welcoming and well-understood entry point to negotiating wit

17、h the business.In this report,you will hear from OSPO leaders across a variety of sectors who will share their journey building open source consumption,contribution,and community engagement strategies for their businesses.You will also learn that each OSPOs goals,success metrics,and approaches to en

18、gagement vary depending upon the drivers for establishing the OSPO,an organizations maturity level with their open source practice,and how internal champions for the OSPOs work support its growth and strategy.No OSPO is exactly like another,even as they share many common responsibilities.Across our

19、combined 30+years of experience working in open source,the common thread weve seen that unites all OSPOs is their deep value in enabling collaboration and co-creation,whether thats internally amongst different software teams or competitors working together in an upstream community.OSPOs are one of t

20、he few teams with a clear mandate for bi-directional advocacy,both within the organization establishing norms for engaging with open source projects and championing open source best practicesand externally to the organization,ensuring that a companys actions in a particular community both serve busi

21、ness goals and advance the technical state of the art for all players.It is precisely because of the flexibility and bi-directional nature of the OSPOs mission that these groups can be the foundational strategic lynchpin of a businesss technology approach.OSPOs have the freedom to explore and suppor

22、t innovations for the business and to define how this engagement will work to best satisfy the objectives of all players,from engineering talent to business executives to the open source project community itself.OSPOs act as the conduit and connective tissue between each group of stakeholders,diplom

23、atically ensuring the interests of all parties are heard and considered,and negotiating for the best possible outcomes for all parties collaborating and co-creating together.It is this inward and outward-facing service mission that is the real magic of the OSPO.In this role,the successful OSPO acts

24、as a diplomat for its organization in the wider world,charged with representing the needs of the business to the community and the communitys needs to the business.OSPOs have a unique role to play as stewards of industry-wide best practices,a locus of collaboration and co-creation,and a conduit for

25、change agency as their company evolves in the ever-changing market landscape.For those who have worked in the open source space for the past decades,or for readers who are early in their open source journeys,this whitepaper will present key areas of challenge and opportunity for the OSPO,shared from

26、 senior OSPO leaders across a variety of industries.Wherever you may be in your OSPO journey,from having one lone staffer who focuses on open source software license compliance to having a long-established open 5THE BUSINESS VALUE OF THE OSPOsource strategy,we hope you will find this research valuab

27、le in examining the business value of OSPOs for your enterprise.As you examine the findings from open source leaders in a variety of industries,we hope you will see yourself in their journeys and be inspired.We look forward to your organization joining the community of OSPO practitioners contributin

28、g to the very foundations of open source practice:how we work together,what we do together,and how we all can derive mutual benefit.Kimberly CravenSr.Director,Red Hat Open Source Program Office,Office of the CTOLeslie HawthornSr.Manager,Red Hat Open Source Program OfficeCopyright 2022 TODO Group|Feb

29、ruary 2022 This report is licensed under the Creative Commons Attribution-NoDerivatives 4.0 International Public LicenseThe Business Value of the OSPOOSPOs are built to help students and researchers create and advance open source projects for widespread useACADEMIC OSPO VALUEOSPOs drive compliance,s

30、tandardization,reputation,knowledge sharing,development speed,security,and sustainabilityBUSINESS OSPO VALUEOSPOs are used to produce knowledge for social good through open access to researchACADEMIC OSPO MOTIVATIONMany OSPOs start by cleaning up past ad-hoc open source effortsMINIMUM VIABLE OSPOThe

31、 top KPIs that OSPOs measure include sustaining contributors and project successOSPO MEASUREMENTThe most common internal OSPO challenges include culture,education,defining and measuring successOSPO CHALLENGESTracking project health including commits,maintainers,and contributor activity and diversity

32、 is essential for sustainabilityOSPO MEASUREMENTThe most common OSPO skill sets include counselor,facilitator,environmentalist,and advocateOSPO ROLESOSPOs can help to turn projects from cost centers to profit centersBUSINESS OSPO SUSTAINABILITY7THE BUSINESS VALUE OF THE OSPOIntroduction1 https:/www.

33、linuxfoundation.org/research/a-deep-dive-into-open-source-program-officesWhy do we care about how OSPOs contribute to the business?A well-designed OSPO is the center of competency for an organizations open source operations and structure.Why do we need to understand how OSPOs contribute to business

34、goals?Whether its to advocate for creating a new OSPO,continue funding the OSPO,or even expand the OSPO,champions will ultimately have to connect the dots between the OSPO and business objectives.Whether in a for-profit business or not-for-profit university,no initiative that cant be connected to ou

35、tcomes that matter to the organization is likely to get greenlighted in the first place,nor survive if they cant make a business case for their existence.“OSPOs as a whole need to be nimble,they need to be always ready for the next change,”said Suzanne Ambiel,director of open source marketing and st

36、rategy at VMware.“They need to adapt to the business because theyre serving the business as well as the community.As the business changes and morphs,the OSPO needs to do so as well Its really important that an OSPO be very connected to the business and the business strategy.”Though OSPOs are general

37、lybut not alwayslocated under the chief technology officer(CTO)and include many software engineers,interest in open source and how a company relates to open source is by no means limited to the engineering department.As we found in interviewing OSPO leaders for this report,the OSPO champions in many

38、 organizations were executives who saw both opportunities and,in some cases,potential threats from open source that their companies needed to address strategically.In doing this research,we hope to better understand why open source matters strategically to companies and how OSPOs help organizations

39、proactively manage both the opportunities and threats to their particular business from open source.Hiro Fukuchi,senior alliance manager at Sony,gave an example of this executive interest:The OSPO organized a virtual event with an external expert that the company publicized,and many executives from

40、both Japan and the United States attended.Common threads in unique storiesOne of the challenges in conducting this research is that while there are certainly common threads,not only is each OSPO unique,but the stories behind their creation in the first place and how they contribute to the organizati

41、ons larger goals are also unique.So while we can certainly make some generalizations about why OSPOs matter,who tends to champion them,and how the business value of the OSPO tends to evolve,no two organizations are really alike.“I was reading the Linux Foundation report that came out a couple of day

42、s ago,talking about the different OSPO structures,”said Christine Abernathy,senior director of open source at F5.“What Ive learned is that theyre not all the same.”Just as OSPOs are all structured differently,there is a lot of diversity in their stated goals and the stories of how they came to be.1

43、8THE BUSINESS VALUE OF THE OSPOMethodologyFor this report,we interviewed 12 OSPO leaders from Europe,Asia,and North America in a variety of industries,including two public universities.All the OSPO leaders interviewed are active in the TODO group.Here are the questions we started with:How many team

44、members were on the OSPO at launch?How many are there now?What are the rough salary ranges for team members in the OSPO?What background do OSPO team members come from (e.g.,engineering,legal,marketing)?Whats your industry?Where is the OSPO located in the organization(e.g.,engineering,legal,marketing

45、)?Who was the initial champion for the OSPO?How did the champion(s)sell the OSPO internally?What did they say the value of the OSPO would be?What outcomes or KPIs were set for the OSPO when it was initially started?How has your understanding of the value of an OSPO,and the specific outcome you expec

46、t from your OSPO,changed over time?Do you expect to get the same business value out of your OSPO in the next five years,or do you expect the value of the OSPO to change?What metrics/measurements were collected to track your progress toward those outcomes?How have these metrics changed over time?What

47、 KPIs does your OSPO work toward now?How do you evaluate the OSPOs success?Organization profiles and the relationship with open sourceAn organizations relationship with open source,and therefore the value that it will get from an OSPO,does seem to depend on what type of company it is.Organizations t

48、hat are fundamentally technology companieswhose revenue comes from selling hardware or softwareexperience both different opportunities and threats from open source than organizations whose revenue comes from selling furniture.Technology companiesFor perhaps obvious reasons,companies whose revenue co

49、mes from selling hardware or software see the most direct relationship between open source and their business,and the OSPO is a critical part of managing that relationship.“Pat Gelsinger,our CEO at the time,”said Ambiel,referring to who was one of the OSPO champions at VMware.“Hes the one who really

50、 leaned in and said,We need to build an OPSO,we need to act with strategic intent.”The need for technology companies to approach open source strategically is a core reason they all gave for forming an OSPO.And while there was often executive involvement,it would be wrong to characterize OSPOs as a p

51、urely top-down initiative or one pushed by management on an unwilling team of engineers.Often individual open source enthusiasts within the companies would push for a more formalized relationship with open source at the same time that executives pushed for a more strategic approach.Creating an OSPO

52、was the obvious next step to meet both stakeholders needs.Open source wasnt new at any of the companies we spoke with.They had all been using open source internally for yearsand often had even open sourced internal projects in the pastbut they were becoming increasingly aware of how open source deve

53、lopers can be part of the adoption curve for their own 9THE BUSINESS VALUE OF THE OSPOproducts,and as a result,how important a decent reputation in the open source ecosystem can be.“F5s business has been moving from primarily hardware to software as a service,”said Abernathy.“A lot of the people who

54、 make purchasing decisions like to try before they buy.These could be software developers who gravitate toward open source or even companies and governments who want to see your code in the open so that they can check the vulnerabilities.”So in the case of F5,open source is becoming important not ju

55、st to how the company makes products but also to sales and marketing efforts.The OSPO is necessary to make sure F5 can leverage open source strategically and make informed decisions in situations where open source is relevant.Abernathy,who previously worked in the open source office at Facebook(now

56、Meta),outlined the difference between open source at a place like Facebook and a company like F5.“At Facebook,open source is important,”she said.“But not,like,in terms of revenue.Theyre not building an open source product.So here,its easier to start thinking about the ROI of open source in a more di

57、rect and meaningful way.”In the case of F5,a major trigger for creating the OSPO was the acquisition of open source company Nginx in 2019.The acquisition meant that the Nginx team both joined F5 and became another voice pushing for an OSPO,which also increased the strategic importance of open source

58、.For companies like Aiven,whose core business is tightly related to an open source project or projects,a formalized and strategic approach to open source is perhaps even more criticalbut something they still often lack without an OSPO.Josep Prat,open source engineering director at Aiven,said that ev

59、en given the strategic importance of open source,there was always tension between a need to ship product features and a need to contribute back to open source.When there was an expectation for engineers to contribute to open source in addition to all their other responsibilities,open source contribu

60、tions would always take a back seat.Because of this tension,Aivens executive team decided very early on that there should be a dedicated OSPO whose sole job was to contribute to open source and manage the relationship with the open source communities.In no way is it only open source companies or sta

61、rtups who feel like open source is of massive strategic importance.Chris Xie,head of open source strategy at Futurewei,the U.S.-based research and development arm of Huawei,stated that the company has been aware of both the threat and opportunities from open source for more than two decades,and the

62、OSPO is part of how the company approaches both the threats and opportunities from open source.End user companiesAfter the pure technology companies,there are the tech-forward companies who want to emulate many of what they see happening at pure technology companies,especially in terms of software d

63、evelopment.These are companies that get their revenue from something other than selling hardware or software,and who wouldnt say that building either is particularly core to their business.However,technology is critical to their business operations,and they share a desire to be perceived as a techno

64、logy company as a means to attract top talent and create new revenue streams.One pattern that appears among these companies is that the OSPO and contributing to open source and releasing open source projects are all part of an effort to change the perception of the company as well as to improve the

65、organizations ability to deliver high-quality software,faster.“Spotify has been using and creating open source since the very beginning,but at the same time,we didnt approach it in a strategic way or consider how it created value for the company,”said Per Ploug,OSPO lead at Spotify.“It is critical f

66、or us that open 10THE BUSINESS VALUE OF THE OSPOsource work is elevated to the same level as internal work,so we consider why we do it and how it brings value,so we ensure our engineers invest their time in projects which have impact.”In Spotifys case,the most visible example of this new approach is

67、 Backstage,the companys big bet on building a commercial offering on top of the successful open source project they donated to the CNCF in 2020.Spotify intends to make their investment into Backstage more self-sustainable and to ensure they stay engaged in the open source community long term.Right n

68、ow,they have more than 40 people working on Backstage.We have very ambitious plans for Backstage,which include a commercial strategy that can both fund those ambitions and result in a better end product for everyone.The goal is to move open source from a cost center to a profit center.“Wayfair is a

69、tech company,and it takes the continuous work of many technologists across numerous disciplines to support our operations and growth,”said Natali Vlatko,global lead,OSPO at Wayfair.“In chats with our former CTO,I stressed that the easiest way for us to genuinely and authentically live that mindset i

70、s to build technical products.The surefire way to do that is to build open source and invest back into the open source ecosystem.”While becoming more tech-company-like is certainly a goal for these companies,it remains a means to an end.In some cases,the ends are clear,and it is often being able to

71、hire the best talent as well as improve the quality of the engineering work in-house.Sometimes,though,even these companies start out believing that open source matters but are unable to articulate exactly why or how open source contributes to engineering or business objectives.The establishment of t

72、he OSPO helps them clarify how open source is already benefiting the company and determine how to get even more value from open source.“They had a couple of open source projects that didnt go anywhere,”said Duane OBrien,director of open source at Indeed,about what was going on at the company before

73、he joined.No one thought they were massive successes.“I dont think they had a clear picture of what success meant for themselves,”he said.UniversitiesFor universities,the value of open source and the related value of an OSPO to oversee the relationship between open source and researchers at the univ

74、ersity is different from for-profit companies.However,they often see open source as a way to further the universitys missionan opportunity that until very recently was largely missed.“They dont really have a history of being engaged in open source,”said Carlos Maltzahn,director of the Center for Res

75、earch in Open Source Software at the University of California Santa Cruz.As a matter of fact,he said,while there have been successful open source projects that have originated at a university,in many cases,its been a personal project of an individual student or researcher because most universities h

76、ave little to no support for turning research products into high-impact open source contributions.Thats something hed like to change and sees the OSPO as a way to support students and researchers who create open source projects and help more projects cross the chasm from a graduate student research

77、project to something used in the wider ecosystem.For Jesus Gonzalez-Barahona,professor at Universidad Rey Juan Carlos in Madrid and head of their open knowledge efforts,open source fits into the larger mission related to expanding access to knowledge.“In all of Europe,especially in Spain,universitie

78、s are rediscovering this idea that we need to produce knowledge for society,”he said.Open source software,but also open access to research,is a way to fulfill this mission.Read Spotifys End User Journey Report as an example of how the companys open source contributions have benefited themselves and

79、projects they care about.11THE BUSINESS VALUE OF THE OSPOWhat can OSPOs do for organizations?The reasons behind starting an OSPOAs we look at the value that an OSPO provides,there are two distinct phases.The first phase is the reason behind the OSPOs creation.The second phase relates to the value th

80、at the organization sees as the OSPO matures.In this section,we will address the reasons organizations had for starting the OSPO in the first place and address how the value evolves in a later section.In nearly all cases,there were multiple reasons for starting an OSPO,just as there are multiple rea

81、sons for maintaining and expanding the OSPO as it matures.While there can be educational and social reasons for starting and maintaining an OSPO,this report focuses primarily on the business-related reasons behind having an OSPO,as we have focused the research primarily on for-profit organizations.C

82、omplianceThe most fundamental reason that organizations start an OSPO is because they are aware that their engineers are using open source,but they dont know if theyre complying with the projects licenses.“Open source is unavoidable,”said Cornelius Schumacher,open source steward at DB Systel,the dig

83、ital partner of Deutsche Bahn.“Open source is unavoidable”Given this reality,DB Systel needed to make an organized,centralized effort to ensure that the company complied with open source license requirements as well as managed potential security issues.“Risk management was not the only reason for cr

84、eating the OSPO,but certainly an important part of the decision,”he said.Because new open source projects are being downloaded and used every day,especially in a large organization,the OSPOs role is less about conducting a compliance audit and more about putting technology and processes in place to

85、ensure developers are aware of which licenses are or are not acceptable so that its easier to conduct compliance audits when necessary.Building standardized processes around open sourceRelated to the compliance issue,there was often also a need to move from an ad hoc way of using open source project

86、s to a more standardized process.“Right now we have too much sprawl across our open source dependencies,”Ploug said.Part of the rationale for creating the OSPO was to streamline those dependencies to avoid having multiple projects that accomplish the same things.“Right now we have too much sprawl ac

87、ross our open source dependencies”This would make many aspects of open source management easier,from license compliance auditing to security to investing strategically in open source projects that are important to the companys core process.In addition to building standardized processes around how en

88、gineers can use open source,theres also a need to create standard processes about how engineers can contribute to open source 12THE BUSINESS VALUE OF THE OSPOprojects or even create their own projects.In many organizations,these decisions had previously been made between an individual engineer and t

89、heir manager,the result of which is a blend of approaches and a lack of certainty about what is acceptable.Often part of an OSPOs initial mandate is to create policies about both consuming and contributing to open source that are distributed throughout the engineering organization.The goal is to eli

90、minate bottlenecks and confusion for engineers both in using and contributing back to open source.Improving an organizations reputationImproving an organizations reputation in the open source ecosystem is an important motivator for many companies to create an OSPO.“Our goal was to not only be more s

91、trategic and act with intent but also to elevate our reputation in the open source communityto be perceived as and accepted as a responsible,positive contributor to the open source ecosystem,”said Ambiel,of VMware.This is particularly important because if a company shows up to a project without any

92、kind of pre-existing relationship and suddenly needs a new feature,or a bug fixed,that request wont likely be a priority.Whereas if the company has been consistently investing in being part of the community,when they need something,the community may be more likely to prioritize it.“We need to employ

93、 people who have commit rights,”said Prat,of Aiven,referring to commit rights on the projects Aiven is built around.The only way to get that is through continual investment in the project,which is why Aiven created an OSPO to ensure the company,and the individuals it employs,are active in the commun

94、ity.An OSPO is also a way to share knowledge about how to approach open source.To even be part of the conversation about what it means to use open source strategically,a company probably needs to establish an OSPO.According to Fukuchi,this knowledge sharing is a big part of the value Sony gets from

95、its OSPO.Improving an organizations reputation is ultimately Who starts the OSPOs?While we associate open source with a grassroots effort from individual engineers,the overwhelming trend in the interviews was the support for OSPOs at the executive level.In the case of large technology companies,like

96、 VMware and Futurewei,the OSPO champion was the CEO.“The CEO realized,oh,open source is not just about technology,”said Xie,from Futurewei.“It is about business.So they had open source moved into the Chief Strategy Office,which is where were now.”Even in more grassroots initiatives,high-level buy-in

97、 is common.“I went to our former CTO with that idea myself,”said Vlatko,of Wayfair.“He was very supportive and said,Yes,go ahead but also was very realistic in the sense of I cannot guide you,Im not an expert.And I said,Thats okay.Im the expert.”The obvious takeaway is that in many companies,a strat

98、egic relationship with open source is a high-level business concern,not just a technical problem that a group of engineers should solve.13THE BUSINESS VALUE OF THE OSPOabout being able to work productively with others in the industry as well as being part of the conversation about the direction of k

99、ey projects.“Growing our reputation allows us to be in larger market conversations in the tech world,where we can then have an impact on products and solutions that are important to us,”said Vlatko,of Wayfair.Expanding access to open knowledgeFor universities,an OSPO is a way to increase the impact

100、of research and make it more accessible or useful to the wider community,as well as a way to improve students access to knowledge.“If you have students engaged with reproducing the results,there have already been studies that show that there is a huge,much better learning effect compared to just rea

101、ding papers.”“Its a huge difference whether a student can just read a paper,or they can look at the paper,then go on to an associated public git repository and have all the information there to reproduce the experiment,”said Maltzahn,of UC Santa Cruz.“If you have students engaged with reproducing th

102、e results,there have already been studies that show that there is a huge,much better learning effect compared to just reading papers.”This is important for student retention.Many students leave computer science prematurely because they get too frustrated by the steep learning curve of getting brittl

103、e experimental systems to work in computing environments even experts dont fully understand.Incorporating the practicality of open source into how students learn and reducing the frustration they experience can help them be successful with computer science in the short term and software development

104、in the long term.Improving development velocityNo one starts building a product by creating an operating systemnothing would ever get built.“There are parts of our products that consist almost entirely of open source software,and that is a fundamental change in the long history of Ericsson,”said Geo

105、rg Kunz,open source manager at Ericsson.Not only does an OSPO bring order to how the company is consuming open source projects,but it can also provide guidance about which projects to use.Improve access to talentThere are two ways that open source improves access to talent.The most obvious way is by

106、 allowing organizations to hire higher caliber engineers,either by improving their general reputation in the open source world or even by creating their own open source projects and hiring from the pool of people who become active in those projects communities.“My boss and executive sponsor want to

107、know that we have a healthy relationship with the open source community because we need to hire from it,”said OBrien,of Indeed.“One of the biggest challenges we havelike other IT companiesis finding people to do all the software work”The other way an OSPO,and the strategic approach to open source th

108、at comes with it,can improve access to talent is by creating open source projects that solve an organizations problems,particularly when solving problems that are common in many organizations,14THE BUSINESS VALUE OF THE OSPOand solving them doesnt provide any competitive advantage.“One of the bigges

109、t challenges we havelike other IT companiesis finding people to do all the software work,”said Schumacher,of DB Systel.If the company can create an open source project and collaborate with others in the industry,it can leverage tech talent without having to hire more people.According to Schumacher,e

110、ncouraging engineers to both use and contribute to open source is also one way to make them happy and less likely to leave.Similarly,encouraging more engineers to create open source projects and do more work in the open is a way to upskill the workforce you already have.“If we are showing our code e

111、xternally,if were showing our technical prowess externally,there is a certain kind of element of needing to put your best foot forward,”said Vlatko,of Wayfair.She says that as Wayfair has encouraged people to work more in the open,theyve seen code quality and general adherence to best practices impr

112、ove.Mitigating risksThere are different risks from open source,and a formal OSPO can help mitigate all of them.One reason to formalize the OSPO structure is that one or two engineers are fulfilling an OSPO-like role but without the title or structure.This is what happened at Ericsson.“We basically h

113、ad a one-person OSPO,”said Kunz.“He took care of everything,mostly focused on compliance,as many OSPOs start out doing.But obviously,thats not sustainable.This guy should not get run over by a bus.”Creating the OSPO formalizes what has often happened in an ad hoc way,reducing the reliance on tribal

114、knowledge and lowering the risk that the departure of a single critical person could put the company at risk of legal issues,security incidents,or just being left out of the open source conversation.SecurityEnsuring a company is staying as secure as possibleand particularly understanding the softwar

115、e bill of materials going into both internal and external applicationswas a recurrent theme about how the OSPO provides value.“We cannot develop our own security framework without being in tune with whats being developed collaboratively in the community”However,the examples were on a strategic,rathe

116、r than strict implementation,level.“We cannot develop our own security framework without being in tune with whats being developed collaboratively in the community,”said OBrien,from Indeed.“Then you take that,and you apply that across every domain.”“By design,its a distributed problem,”said Kunz,of E

117、ricsson,about software supply chain security.“Its not the best engineer who will solve this problem,and you cant solve this problem with an internal process.”Its something that requires working with others throughout the industry and the open source ecosystem.An OSPO gives organizations a way to do

118、that,even if the OSPO is not ultimately responsible for implementing security processes.They do share best practices and facilitate collaboration among open source communities,industry actors,foundations,and other stakeholders to lift all security boats.Security is also a reason why organizations wa

119、nt to be involved and respected community members in projects that are strategically important to 15THE BUSINESS VALUE OF THE OSPOthem.This allows them to be part of the behind-the-scenes conversations not only about any new features in the pipeline but also to learn about any potential security iss

120、ues first.SustainabilitySometimes open source projects are abandoned,and that can be bad if you depend on them.“If we have a strong dependency on a single maintainer in Norway,then you should probably do something about the relationship with that person to make sure they stay engaged,either by ensur

121、ing that our developers spend time on the projects or by sending some money,”said Ploug,of Spotify.An OSPO both helps identify the riskotherwise,the fact that it is a single maintainer could be unknownand identify the best way to mitigate that risk.This precise issue is what led OBrien,at Indeed,to

122、create the FOSS contributor fund,which is a way for Indeed to financially support maintainers of projects it depends on.The programs goal is to support maintainers who are at high risk of burnout as a way to mitigate the risk that the project will end up abandoned.Whos in the OSPO?The majority of OS

123、PO leaders we spoke to had a software engineering background,but the work most of them do on a day-to-day basis is often not related to writing code.Instead,there are elements of internal communication,strategic planning,analysis,event planning,and collaboration with external organizations,which inc

124、lude open source communities,foundations,and other industry peers.In most cases,OSPO team members,and especially OSPO leaders,were senior engineers or at the management level.In companies with very structured salary bands,the OSPO leadership and team members would be toward the top of the salary lad

125、der.Given the importance of legal compliance for many organizations when the OSPO starts,it is notable that most OSPOs had access to legal expertise,either inside or outside the OSPO.However,none of the interviewees felt that there should be an expansion of the role of legal or that they needed addi

126、tional legal expertise.16THE BUSINESS VALUE OF THE OSPOThe OSPO journeyThe first step for many OSPOs,before they can begin to address more strategic concerns,is what many OSPO leaders described as cleaning up the mess of open source,recovering from years of ad hoc approaches to consuming and contrib

127、uting to open source.“Weve had 10 years of publishing projects without a longer-term plan or formalized ownership,”said Ploug,of Spotify.The OSPO is currently going through all the projects that the company has created,figuring out who owns themand making sure that ownership is assigned to a team,no

128、t an individual.There is also a process of determining which projects can be shut down,which requires confirming that there is no internal use.Other work that OSPOs often tackle initially is finite and can,at some point,be finished,such as the initial question about which licenses can or cannot be u

129、sed.Usually,the OSPO can work with the legal team to figure out what is or is not acceptable,but once there is a decision,it doesnt need revisiting and becomes a matter of communicating to the entire organization what licenses are acceptable in which scenarios.But what do organizations do once they

130、have already organized their internal projects,developed frameworks for how to use and contribute to open source,and sufficiently addressed compliance?Overcoming internal obstacles:Culture and educationOnce an OSPO has developed policies around using and contributing to open source,a common next ste

131、p is to spread the word internally.This is not a trivial consideration,especially given that many OSPOs are only a handful of people in an organization with thousands or even tens of thousands of engineers.This internal communication role of the OSPO also goes back to one trigger for creating the OS

132、PO in the first place:a large number of queries coming from software engineers about how to relate to open source.“When we are talking about contributing to open source software,in the beginning,the question we started with was,are we even allowed to do that?”said Schumacher,from DB Systel.People ju

133、st did not know what parameters there were about using,and especially around contributing back to,open source.If one of the first-level goals of an OSPO is to figure out what those parameters are,the secondary goal is to make sure that there is a dissemination of knowledge throughout the organizatio

134、n.According to Vlatko,from Wayfair,after setting up an organizational structure in GitHub and figuring out the license types that were acceptable for use,there was an educational campaign to ensure that information was widely known across the organization.But aside from preemptively answering engine

135、ers questions about interacting with open source,there is an even larger shift in how people think about open source.“The question has changed a bit from whether or not to do open source to how to do open source strategically,”said Schumacher.“What Im seeing now,after some time,is that we are lookin

136、g more into the strategic part of how you can leverage open source,for example,in collaborations with external companies.”Even though open source is everywhere,not all organizations have the culture around open source that they want,and opinions about open source are far from universally positive.So

137、me people,from individual contributors to managers and executives,have had bad experiences with open source software or open source communities at some point in their careers,and convincing those people to embrace open source is part of the OSPOs challenge.17THE BUSINESS VALUE OF THE OSPO“We want to

138、 create a cultural mind shift and grow the community around open source,”said Abernathy,at F5.This will be a major driver in helping the company play a larger role in the open source ecosystem.In a real sense,OSPOs seek to improve open sources reputation within the organization just as much as the o

139、rganizations reputation within the open source ecosystem.A strategic relationship with open sourceThere is no doubt that the strategic importance of open source varies depending on the type of company.For a company like Futurewei,open source alternatives to the“black box”solutions it sells are a fun

140、damental threat to the companys ability to generate revenue.“And how you deal with this as a business,not a technology decision,”said Xie.In a similar vein,VMwares Ambiel stated,“At the end of the day,what does VMware do?We sell software.So,our open source investments need to align with our business

141、 aspirations.”The OSPO is there to make sure that happens.At Spotify,theres an ambition to spin out the companys two most successful open source projects into separate business units that will launch commercial products based on the projects,turning the project from a cost center to a profit center.

142、Part of the OSPOs role at Spotify is to help identify and launch new projects that could potentially become new business units and support them in a way that increases the likelihood of success.18THE BUSINESS VALUE OF THE OSPOThe different hats of an OSPO 2 https:/www.linuxfoundation.org/research/a-

143、deep-dive-into-open-source-program-officesThe CounselorSometimes a strategic approach just means stepping back and taking the time to think through some of the hard questions about what type of engagement model is right for any particular project or how involved the organization should be in each pr

144、oject.There is also the question of when it makes sense to contribute to an existing project versus creating a new project.An OSPO that is having these strategy-level conversations will be able to provide guidelines to engineers so that engineers do not have to consider the business implications of

145、different open source engagement models every time they try to solve a problem.The FacilitatorThe OSPO also plays a sort of translation role between engineering teams and business interests regarding open source.“How do we ensure that engineers keep having the time to do this,that they can actually

146、prove that it makes sense from a business perspective?”said Abernathy,about how communicating the business value of open source is part of the OSPOs job at F5.These strategic questions are not always top of mind when the OSPO is first created,especially at less tech-focused companies where open sour

147、ce doesnt present a direct threat to revenue.But even those companies eventually see that using open source well is about more than mitigating license compliance risk.“Now we are also looking into more cases where it makes sense from a strategic point of view to leverage open source for our own proj

148、ects or in collaborations with other parties,”said Schumacher,even though he does not think these strategic concerns were as important when the OSPO was initially set up.Ensuring OSPO sustainabilityContinuity is an ongoing challenge for organizations as they adapt to changes in the business,the comp

149、etitive landscape,and the larger technological ecosystem.According to“A Deep Dive on OSPOs,”a Linux Foundation whitepaper,OSPOs need to establish a clear,easy reporting process and ensure lines of communication stay open with all the stakeholders.This is important for maintaining internal support fo

150、r the OSPO,which is critical to ensuring that the organization continues to follow its agreed-upon open source strategy and is able to work sustainability on open source projects and priorities.219THE BUSINESS VALUE OF THE OSPOMeasuring an OSPOs success“When I interviewed for this role,I asked how w

151、ere going to measure success,”Prat said.“They said we dont know yet.”This pattern of uncertainty came up often in interviewsthat an executive leader championed an OSPO with the understanding that open source is important and that the company needed to take practical,tactical steps to ensure complian

152、ce and security,while also figuring out how to engage strategically along the way.In many cases,they did not really know what that looked like,and part of the OSPOs initial mandate was to figure out what success would look like and how to measure their own progress.There were some metrics interviewe

153、es talked about using to measure engagement with open source but then ultimately rejected.Pull requests(PRs),for example,are too diverse to provide meaningful informationa PR could be a typo fix or a major feature.Measuring hours worked on open source also did not seem right because it does not meas

154、ure impact.Deciding what to measure is fairly high-stakes and strategic,part of why the OSPO leaders themselves took on the task of figuring it out.Human nature is to optimize for the things we know were being evaluated on,and interviewees talked about the importance of choosing metrics that will en

155、courage engineers throughout the organization to be better open source citizens.Often the metrics applied initially changed as the OSPO matured.For example,at Indeed,there was an initial focus on growing contributors and measuring how many people make open source contributions in any given quarter.A

156、fter a while,however,they started focusing on growing what they called“sustaining contributors,”who are people that make repeated contributions to the same projectto projects that are strategically important to Indeed.This is because it is easier for maintainers to get five contributions from one pe

157、rson than five contributions from five people,and the larger goal is to make things easier for maintainers.Oftentimes,it is simply difficult to quantify what matters about an OSPOs performance in numbers.“My personal measure of success is to continue to elevate VMwares reputation and leadership in o

158、pen source,”said Ambiel.“And the measures of success I have for that are fairly qualitative.”She talked about perception studies,share of voice,and times when the community organically shared VMwares story or contributions.Individually,those metrics might be squishy,but together they“add up to a bod

159、y of work that says were making progress.”Common OSPO KPIsSo,what did the OSPOs end up measuring once they had time to consider what metrics encouraged good behavior and were truly aligned with the OSPOs goals?Sustaining contributors:The number of people in the organization who make regular,repeat c

160、ontributions to the same project,assuming those projects are strategically important to the organizationThe success of projects released:The external participation and impact of projects the organization releases.OBrien gave the example of a project Indeed released that the CNCF Sandbox accepted as

161、a measure of huge success.Maltzahn,from UC Santa Cruz,mentioned the importance of measuring not just the projects released,but how successful they became at attracting a broader following outside the university and whether they would be viable long term without the continuing involvement of the univ

162、ersity.The reputation of open source internally:Do people even know the OSPO exists?Do they know what the parameters the OSPO has established around how to consume open source,contribute to existing projects,and/or create a new project?Many companies 20THE BUSINESS VALUE OF THE OSPOtrack these inter

163、nal awareness metrics,as a large part of their role is internal communications.The reputation of the organization among the open source community:For the many companies who established an OSPO as a way to improve the organizations reputation among the larger open source ecosystem,they often track re

164、putation and awareness metrics,such as social media mentions,the number of job applicants who mention the companys involvement in open source,or the number of employees speaking at open source-related conferences.Some do surveys of developers run by third parties and ask reputation-related questions

165、.Reducing friction for developers:In addition to tracking how aware the internal team is of policies,OSPOs often track how much friction they create for those developers.If a human needs to approve a request to contribute,for example,how long does it take?Tracking project health:Tracking the percent

166、age of projects the organization depends on that are“healthy.”Determining a projects health would often involve tracking the number of active contributors,the frequency of commits,the number of maintainers,and other metrics,including having users and contributors from many different organizations.Ex

167、ternal collaboration:How many partners is the OSPO actively collaborating with?This can take the form of participation in joint ventures or sponsored programs,particularly among universities,or being actively engaged in open source foundations and industry groups.Other examples of active,external co

168、llaborations include participation in conferences as speakers,delegates,or sponsors,as well as engaging in the research development process,as many of the interviewees in this report have demonstrated.There are also joint projects to determine the best metrics to track:The TODO Group and CHAOSS crea

169、ted the OSPO metrics working group3 to help develop better metrics for OSPOs to measure their own success.3 https:/ KPI searchMany OSPO leaders stressed that talking about quantitative metrics is not only difficult but can lead to misleading conclusions.Many OSPOs just do not have very measurable go

170、als.“Our goals for the team are relatively high level,”said Kunz,from Ericsson.“I would say we step away from numbers,”said Ambiel,from VMware.“Numbers dont tell the story and can be misleading in open source.”Part of the danger in focusing on numbers,Ambiel said,is that the ultimate goal of the OSP

171、O is to push the company to be a better citizen in the open source ecosystemand being a good citizen is never-ending.“There isnt a metric where you can say,okay,Im done.Check that off,”she said.“You can always lean in;youre always trying to be better.”There can also be problems with timespans.“Every

172、 company tries to measure things in three-month timespans,”said Prat,from Aiven.But an open source maintainer does not care that you need to meet your quarterly goals for accepted contributions;they do not arrange open source projects around quarterly goals or fiscal years.There was also a sense tha

173、t OSPOs are continually evolving and,therefore,the right KPIs to track are also constantly evolving.“We are now searching for that good KPI because our activities are changing,and the status quo has changed,so we need to adjust KPIs,”Fukuchi said.For further reading about OSPO Maturity models,check

174、out these resources here:OSPO Maturity Model(Whitepaper)OSPO Maturity Model(Repo)OSPO Maturity Model (Open Source Blog Article Explained)21THE BUSINESS VALUE OF THE OSPOConclusionWhats coming in the future?On one point,there was absolute agreement among all interviewees:OPSOs will continue to evolve

175、 in the future.In particular,the more established an OPSO is,the more it can think strategically and help the entire organization develop a more strategic,thoughtful approach to open source.What they do not need or expect is more focus on legal and compliancethat is a checkbox that most interviewees

176、 feel is more like the bare minimum and that they have got it covered already.Several interviewees spoke about expecting OSPOs to play a larger role in influencing which technologies and projects their companies adopt in the future.There was also a hope that OSPOs will be able to dive deeper into th

177、e dependency chain to better understand which projects they depend on,even if it is two or three levels down,and track the health of those projects(and contribute where necessary).Others talked about building out automated platforms to handle some of the tasks that are now manual,like approving a re

178、quest to contribute to a project.“The OSPO needs to work on a strategy,set it up,and then bring the R&D folks on board to do the right thing,”said Kunz.The OSPO,Kunz and many others believe,should be working on vision and strategy and making sure theyre working with the right people throughout the c

179、ompany to turn that vision into reality.Ultimately,part of the OSPOs role is to have these conversations about open source,OSPOs,and the business value it delivers.That is part of open source evangelism,which is already part of many OSPOs mission.“I think an important part of that is really making p

180、eople understand the business value,”said Schumacher.That is not always easy because open source does not always translate neatly to the things business leaders think about,but its important.Business leaders often know that open source is important,but they need an OSPO to help them understand why a

181、nd then use that knowledge to get even more value out of open source.Future researchIn this report,we have focused on the value of the OSPO in private institutions.One area of future research we would like to explore is how OSPOs provide value to governments,from municipalities to supra-national org

182、anizations.We would also like to do research that explores the role and the value of OSPOs exclusively at institutions of higher learning.If you have any thoughts about either subject or would like to share your insights,contact us at researchlinuxfoundation.org.22THE BUSINESS VALUE OF THE OSPOAbout

183、 the authorsEmily Omier helps open source startups accelerate community and revenue growth with better positioning and messaging for both open source projects and commercial offerings.Ana Jimnez Santamara is the OSPO Program Manager at the TODO Group,a Linux Foundation project that brings together O

184、SPO practitioners to collaborate on developing best practices,tools,and educational resources to drive successful Open Source Offices within organizations.Ana has a strong background in Open Source,DevRel,Community Health Analytics and InnerSource.She previously worked at Bitergia,a software develop

185、ment analytics firm,where she completed her MSc in Data Science.Her thesis focused on measuring the success of Developer Relations in Open Source communities.For more details on her thesis work,check out:https:/anajimenezsantamaria.gitlab.io/.With her commitment to open source education,Ana is dedic

186、ated to helping organizations and individuals build healthy connections in the Open Source ecosystem.You can find Ana on Mastodon,LinkedIn,and Youtube.Chris Aniszczyk is an open source technologist with a passion for building a better world through open collaboration.Hes currently a CTO at the Linux

187、 Foundation focused on developer experience and running the Cloud Native Computing Foundation(CNCF).In a previous life,he created the Twitter open source program and led their open source efforts.Also,for many years he served on the Eclipse Foundations Board of Directors representing the maintainer

188、community and the Java Community Process(JCP)Executive Committee.Furthermore,hes a partner at Capital Factory where he focuses on mentoring,advising and investing in open source and infrastructure focused startups.23 mastodon.world/todogroupTODO is a global community of OSPO practitioners from diver

189、se sectors and regions.Its General Members include representatives from 90+organizations with extensive experience in running successful open source programs.TODO aims to foster collaboration on best practices,tools,and guidance for managing open source projects through OSPOs.By sharing experiences

190、and developing common tooling,TODO seeks to improve OSPO adoption and education.Explore TODOs ongoing initiatives like OSPOlogy and active working groups,and check out the OSPO landscape,OSPO 101 training modules,and TODO Guides to learn more.Founded in 2021,Linux Foundation Research explores the gr

191、owing scale of open source collaboration,providing insight into emerging technology trends,best practices,and the global impact of open source projects.Through leveraging project databases and networks,and a commitment to best practices in quantitative and qualitative methodologies,Linux Foundation

192、Research is creating the go-to repository for open source insights for the benefit of organizations the world over.Copyright 2023 The Linux FoundationThis report is licensed under the Creative Commons Attribution-NoDerivatives 4.0 International Public License.To reference this work,please cite as follows:Emily Omier,Chris Aniszczyk,and Ana Jimnez Santamara,“The Business Value of the OSPO:An Exploration of Why Organizations Create,Sustain,and Expand Open Source Program Offices(OSPOs),”forewords by Georg Kunz,Leslie Hawthorn,and Kimberly Craven,The Linux Foundation,March 2023.