License Obligations

License obligation manifest: attribution, source disclosure, copyleft, patent grants.


Short name	Obligations
Region	Internal
Country or scope	Internal
Sector	Open Source
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Obligations

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for Obligations.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for Obligations and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`LIC-OBL-COVERAGE` License Identification	The license of each software component must be identified before its obligations can be honored (ISO/IEC 5230:2020 §3, license compliance artifacts)	Scan
`LIC-OBL-INV` Complete OSS Inventory	A bill of materials of all open-source components is a prerequisite for any obligation analysis (ISO/IEC 5230:2020 §3, bill of materials requirement)	Scan
`LIC-OBL-ATTR` Attribution Data Completeness	Attribution notices must name the component and its version, so entries need both fields populated (attribution conditions in common OSS licenses, e.g. Apache-2.0 §4, per SPDX license texts)	Scan
`LIC-OBL-ORIGIN` Copyright Holder Attribution	Honoring attribution and copyleft duties requires knowing the originator/supplier of each component (attribution and notice-preservation conditions in OSS licenses, per SPDX license data)	Scan
`LIC-OBL-SRCVER` Exact Versions for Source Disclosure	Copyleft source-disclosure duties attach to the exact distributed version, so vague versions or ranges make compliance unverifiable (source provision conditions, e.g. GPL-2.0 §3, per SPDX license texts)	Scan
`LIC-OBL-FMT` Machine-Readable License Manifest	License obligations should be tracked in a standardized machine-readable format supporting SPDX license expressions (ISO/IEC 5962:2021 SPDX license expression syntax)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`LIC-01`	Attribution Requirement Fulfilment
`LIC-02`	Source Disclosure Compliance
`LIC-03`	Copyleft Boundary Enforcement
`LIC-04`	Patent Grant Verification
`LIC-05`	License Compatibility Matrix
`LIC-06`	Commercial License Tracking
`LIC-07`	Unknown and NOASSERTION License Handling

Policy templates

Written for Obligations:

License Obligation Compliance Policy
Commercial License Tracking and Compliance Policy
License Compatibility and Distribution Clearance Policy

And 22 from the standard set, adapted to Obligations.