By NakodaX Engineering team
NakodaX ·
NakodaX blog/Perspective·4 min read
What do ISO/IEC 5230 and ISO/IEC 18974 mean when you buy software?
ISO/IEC 5230 says a software vendor runs a real program for the licenses of the open source it ships. ISO/IEC 18974 says the same for known vulnerabilities in that open source. Both apply to a program, not a product. NakodaX is compliant with both, with one program for all three products, listed by OpenChain.
Ask a vendor what is inside the software it supplies, and who answers when something is wrong.
Almost every product you buy is mostly open source underneath. A web app can carry hundreds of outside components, each with its own license and its own history of security fixes.
That is normal and healthy. The question for a buyer is whether the vendor knows what is inside, meets the licenses and fixes known problems. Two international standards from the OpenChain Project, part of the Linux Foundation, give a short way to ask.
What is ISO/IEC 5230?
ISO/IEC 5230 is the international standard for an open source license compliance program. It was published in 2020 and grew out of the OpenChain specification.
It asks for a written policy, named people who are trained for their roles, and a clear scope: which software the program covers. For every release in that scope there must be a record of the open source components in it, and the license duties must be met when it ships, such as notices and offers of source code. There must be a public contact for license questions, and the program must be reviewed at least every 18 months.
What is ISO/IEC 18974?
ISO/IEC 18974 is the matching standard for open source security assurance. It was published in 2023 and builds on the same structure.
It asks a vendor to keep a bill of materials for the software it supplies, to check those components for known vulnerabilities, to decide on each one, to fix the ones that matter and to keep watching after release. Anyone outside the company must be able to report a vulnerability and get an answer.
| What you want to know | ISO/IEC 5230 | ISO/IEC 18974 |
|---|---|---|
| Does the vendor know what is inside? | A record of open source components for each release | A bill of materials for supplied software |
| Are the licenses met? | Yes, notices and source offers at release | Not its subject |
| Are known vulnerabilities handled? | Not its subject | Yes, found, decided and fixed |
| Who answers my questions? | A public contact for license questions | A public contact for vulnerability reports |
| How often is it checked? | At least every 18 months | At least every 18 months |
What does conformance tell a buyer?
It tells you the vendor has done the work that matters: a named owner, a list of what ships, rules for which licenses are allowed, and a way to answer you. That saves rounds of questionnaire answers and gives your legal and security teams something specific to check.
Conformance applies to a program, not to a product. Read the scope to see which products and delivery channels it covers. It matters most where the vendor's software runs inside your own systems, such as a browser extension, an SDK in your code, or an install on your own servers.
What should you ask a software vendor?
These questions work whether or not the vendor claims conformance.
- Is your open source program conformant to ISO/IEC 5230 and ISO/IEC 18974, and is it listed by OpenChain?
- Which products and delivery channels does the scope cover, and what does it leave out?
- Can you send a bill of materials for the release we run?
- Where are the license notices for the software you supply us?
- If we run your software on our own servers, how do you tell us about a security fix?
- Who answers license questions and vulnerability reports, and at which address?
- When was the program last reviewed?
How does NakodaX run its open source program?
NakodaX runs one program for Document Protection, Data Protection and Source Protection. The scope is the software we supply: the web apps, the browser extension, the SDKs and DataGuard packages, the command line tools, and the installs that run on a customer's own servers.
Each supplied release gets a bill of materials, a license check, a notices file and a vulnerability scan. Licenses that could put your business at risk, such as AGPL and SSPL, are kept out of what we supply. Customers who run NakodaX on their own servers are told when a fix affects them.
This matters because some of what we supply runs inside your systems. Source Protection puts a runtime into customer deployments, and NakodaX can be installed on your own servers for on premises installs and pilots, even offline, as in software running inside a government agency.
License questions go to opensource@nakodax.com and vulnerability reports to security@nakodax.com. ISO/IEC 5230, ISO/IEC 18974, CSA STAR Level 1 and the rest of our compliance are on the security page.
What does this not do?
It does not ask you to take our word for it. Ask us for the bill of materials and the license notices for the release you run, and we will send them.
It does not add work for your team either. One program covers Document Protection, Data Protection and Source Protection, so one answer serves every NakodaX product you use.
The takeaway
ISO/IEC 5230 and 18974 turn open source questions into a short, checkable list. Read the scope, then ask for the bill of materials.
Common questions
Is NakodaX compliant with ISO/IEC 5230 and ISO/IEC 18974?
Yes. NakodaX is compliant with ISO/IEC 5230 and ISO/IEC 18974 and is listed by OpenChain. One open source program covers Document Protection, Data Protection and Source Protection.
What is the difference between ISO/IEC 5230 and ISO/IEC 18974?
ISO/IEC 5230 covers open source license compliance: knowing every component you ship and meeting its license. ISO/IEC 18974 covers open source security assurance: finding known vulnerabilities in those components, deciding on each one and fixing it.
Which NakodaX products does the open source program cover?
All three: Document Protection, Data Protection and Source Protection. It covers the software NakodaX supplies, including the web apps, the browser extension, the SDKs and packages, the command line tools and installs on your own servers.
