ISO/IEC 5230 is an international standard for open source license compliance programs, maintained by the OpenChain Project. It describes the processes an organization should have. It does not certify any individual piece of software, so it tells a buyer about your habits, not about the license status of a given release.
What the standard covers
According to the OpenChain Project, the standard identifies where license compliance processes should exist, how roles and responsibilities are assigned, and how the program stays sustainable over time. It applies to past, current and future products or services.
OpenChain also maintains ISO/IEC 18974, a standard for open source security assurance programs. The two sit side by side: one is about license obligations, the other about handling vulnerabilities in open source.
How organizations conform
The project describes a self-certification route, using an online checklist and materials on GitHub. Organizations can also use official OpenChain partners for independent assessment or third-party certification. Which route a company took matters, so ask which one it was and what evidence exists.
Process standard versus product audit
| Question | Process standard | Product audit |
|---|---|---|
| What does it look at? | Policy, roles, training, procedures | Actual components in a release |
| What does it prove? | A program exists and is followed | What was found on the scan date |
| How often is it useful? | As a signal of maturity | Before each deal or release |
A buyer who sees conformance still needs the component list for the product being bought. A conformant company can still have an unusual license in one repository. The reverse is also true: a small team without the standard may have a very clean codebase.
When a buyer might ask
Procurement teams in some sectors ask about it in questionnaires, mostly to see whether a supplier has a repeatable approach. If you do not conform, say so plainly and describe what you do have: a written policy, an SBOM for each release and a review step. Do not imply a certification you have not completed.
Steps if you are considering it
- Read the standard and the free checklist from the OpenChain Project.
- Map each requirement to what you already do.
- Write the missing pieces: a policy, role assignments, a record of reviews.
- Decide between self certification and an external assessment.
- Keep the evidence somewhere an auditor can find it.
Safeguard offers SBOM and dependency scanning plus compliance and evidence automation, which can help you keep an inventory and supporting records current. A free scan shows the inventory side.
Quick check
Is ISO/IEC 5230 a certification of my product?
No. It is a process standard for an organization's compliance program. It does not certify an individual product.
Is it required for selling software?
Not by itself in general. Some buyers ask about it, and requirements depend on the customer and contract.
Sources
Last reviewed: 19 October 2026.
