Many organizations discuss open source policy, OSPOs or software supply-chain security. This session shares a practical example of how one public-sector organization developed these capabilities over time.
The session shows how work started with something simple: creating insight into existing open source usage. From that foundation came assessment processes, SBOMs, licensing guidance, supply-chain visibility, policy and eventually strategy.
The value of the session is that it presents a realistic progression instead of a target operating model. Attendees will see how different activities built on each other over time, what challenges were encountered and how operational experience became the basis for policy and strategy.
The lessons are relevant for organizations that are building or maturing OSPOs, improving software supply-chain visibility, or looking for practical ways to manage open source at scale.
