Open Source & Digital Sovereignty

Digital Sovereignty: Analysis & Strategy

We analyse the independence of your IT landscape as well as the sovereignty of the products and services you offer your customers. In doing so, we identify critical dependencies on proprietary vendors and develop a prioritised roadmap. In this way, we uncover feigned sovereignty (‘sovereignty-washing’) and establish genuine control across the dimensions of infrastructure, software, data and expertise.

OSS Strategy & Implementation

Unmanaged use of Open Source Software creates risk and leaves strategic potential untapped. Based on an analysis of your status quo and your risk appetite, we define strategic use cases – for example within your core business areas. The management system built on this then governs all three scenarios (Use, Contribute, Create) through clear policies, safeguards compliance through active licence management, and fosters innovation.

Migration to OSS & Substitution Roadmap

Sovereignty begins with transparency. Only those who are aware of their critical dependencies – from licensing models to cloud services – can take targeted countermeasures. Accordingly, we identify and evaluate suitable Open Source alternatives and develop a prioritised migration roadmap. This takes into account realistic timeframes and costs, and serves as a structural safeguard against vendor lock-in and concentration risks.

OSS Security & Compliance

The use of OSS poses potential risks to your software supply chain. These range from critical vulnerabilities (CVEs) and malicious project infiltration to licence conflicts. We optimise your security management holistically: first, we assess your maturity level by benchmarking against the Linux Foundation’s OpenChain standard. We then implement the appropriate toolchain, define policies and embed the requirements (ISO 5230 / ISO 18974) within your organisation. 

Learn more

Find further Information on:

• Cyber Resilience Act

OSS Toolchains for Compliance & Security

An integrated toolchain forms the basis for efficient OSS management. Through SCA (Software Composition Analysis) tools, it enables automated compliance and security scans as well as end-to-end Software Asset Management (SAM). Combined with risk-based approval strategies and licensing guidelines such as OSS Licence Charts, it streamlines your processes, ensures legal certainty and scales with your business requirements.

Code Scanning, SBOM Creation & Curation

Creating a complete and compliant Software Bill of Materials (SBOM) requires in-depth specialist knowledge and ties up valuable resources. We take care of this process for you. Using specialised tools, we scan your source code for compliance and security risks, curate the results and clean up the identified components. Finally, you receive a complete SBOM in a standardised format (e.g. SPDX, ISO 5962), thereby creating transparency in your supply chain.

ISO 5230 & 18974: Audit & Certification

 As an external certification body, we support you every step of the way towards verifiable compliance with ISO 5230 and ISO 18974. A Readiness Check and a Dry Run Assessment are used to evaluate the effectiveness of your processes (design and operational effectiveness). You will receive a status report with specific recommendations on how to achieve certification readiness before we carry out the formal audit (Phases 1 & 2) leading up to the final award of the certificate.

Supply Chain Security & Compliance Audit

Reduce your internal audit workload and minimise risks in the software supply chain: we take care of auditing your suppliers – either as a targeted one-off project or as a fully managed programme. In doing so, we assess OSS management practices in accordance with ISO 5230 / ISO 18974 or as part of a bespoke OSS audit programme. We also verify the quality of SBOMs through spot checks and present progress transparently in a live dashboard.

OSS Due Diligence & M&A Assessment

Software is a key asset in M&A transactions. However, unrecognised OSS risks can reduce the value of the transaction. We safeguard your transactions through targeted OSS due diligence. Based on the assessment scope, we carry out tool-assisted code scans, assess licence and security risks, and review the maturity level of the management system. The result: a well-founded report and a Software Bill of Materials (SBOM) to inform your decision-making.

InnerSource & Transfer Pricing

InnerSource unlocks significant innovation potential through the reuse of code, but requires clear governance across technical and legal boundaries. To this end, we define the necessary roles, plan processes and the technical infrastructure – such as internal code repositories – and empower teams through training. Particular focus is placed on the legally compliant tax assessment of code sharing within corporate groups, in order to establish an audit-proof transfer pricing model.

OSPO Setup, Benchmarking & Optimisation

We support you throughout the entire process of implementing your Open Source Program Office (OSPO). The starting point is a thorough on-site assessment: we evaluate the maturity of your processes and tools against industry standards and identify areas for improvement – from opportunities for optimisation to gaps in automation. As a result, you have a fully functional OSPO up and running.

OSPO-as-a-Service

Fließtext & Verlinkung Element 12

400-500 Zeichen inkl. LZ Setting up an OSPO requires specialised staff and in-depth industry knowledge. To ensure you can still use the OSPO as a central hub for managing all OSS activities, we take care of the day-to-day operations as a managed service. We cover the entire product lifecycle, assess use cases against your risk triggers and answer ad hoc queries. This gives you access to specialist knowledge, takes the pressure off your teams and allows you to focus on strategic management.