202205 May 2022 Global Board Meeting

### Overview The May 2022 OWASP Global Board Meeting brought together board members, foundation leadership, and committee representatives to review organizational performance, project governance, and policy updates. Chaired by Vandana Verma, the meeting covered staff operations, finances, vendor neutrality challenges, event planning, and updates from the OWASP Project Committee.

### Key Topics - **Operations and Administration**: The board noted that April meeting minutes were pending an electronic vote (evote). Staff reported progress on community awards nominations, updates to European entity restructuring (moving from Belgium to the Netherlands), and ongoing AMS (Association Management Software) migration planning. - **Financial Health**: Tom presented the financial narrative, reporting strong foundation performance through April 2022. Cash assets and corporate membership were up year-over-year, operational reserves stood at 7 to 10.5 months (surpassing the nonprofit industry average of 6 months), and net income was performing significantly better than budgeted. - **Events and Chapter Growth**: Chapters expanded to 416 with eight new additions. However, low registration for AppSec Europe and fewer Call for Papers (CFP) submissions for the APAC event raised concerns, prompting targeted marketing pushes. - **Vendor Neutrality & Co-Marketing**: The board engaged in a detailed discussion regarding the boundaries of vendor neutrality. Board members highlighted the risks of appearing to endorse commercial products through retweets, co-marketing agreements, or project sponsorships. Consensus formed around drafting explicit, transparent policy guidelines distinguishing neutral co-marketing, sponsor acknowledgment, and member benefits while ensuring zero commercial endorsements. - **Project Committee Update**: Björn Kimminich and Steve Springett presented committee progress, including streamlined incubator-to-lab project reviews (reducing turnaround time to 1–2 months), proposed "good practices" for vendor neutrality and repository management, and a proposal for a new "production" maturity tier between lab and flagship.

### Technical & Governance Details - **SBOM & Standards Alignment**: Andrew reported on discussions in Washington, DC regarding Software Bill of Materials (SBOM) standards, highlighting the friction between SPDX Light and OWASP CycloneDX. The board emphasized the urgency of engaging the CycloneDX team directly with the SPDX initiative to preserve OWASP's influence at the standards table. - **Project Support Resource Request**: The Project Committee raised a funding request ($60,000 FTE) for a dedicated technical community manager to support flagship projects like CycloneDX, Juice Shop, and Dependency-Track, alleviating pressure on Harold Blankenship. Andrew noted this would be considered during the 2023 budgeting process following the AMS rollout. - **Operational Grants Process**: Harold shared a draft operational grants workflow to structure how OWASP accepts external grant funding (e.g., Google, Accenture) versus managing pass-through disbursements.

### Takeaways OWASP remains in a stable financial and operational position, but faces growing governance demands. Priority action items include formalizing a comprehensive vendor neutrality and partnership policy, finalizing external grant operational workflows, advancing the European entity transition to the Netherlands, and evaluating dedicated technical staffing for major open-source projects in the upcoming budget cycle.