A retail company is looking to start a development project that will utilize open source components in its code for the first time. The development team has already acquired several open source compon

Mandating approval by the Information Security Manager is a procedural control that should be defined within an open-source compliance policy, not a standalone first step taken before governance is established.

Scanning open-source components for vulnerabilities is an important security practice, but it is a tactical activity that should be required and governed by an overarching compliance policy rather than implemented ad hoc before any policy exists.

An open-source compliance policy is the foundational governance document that defines rules for selecting, approving, licensing, and managing open-source components across the organization. Without this policy, ad-hoc decisions lack consistency, legal license obligations (e.g., GPL, MIT, Apache) may be violated, and there is no framework under which security scanning, approval workflows, or support requirements can be enforced. Establishing the policy is the logical prerequisite that enables and structures all subsequent operational controls.

Requiring commercial support for all open-source components is one possible policy decision an organization might make, but it is an overly restrictive and costly measure that is not universally required and would itself need to be specified within a compliance policy framework.