Contributor License Agreements

This document introduces two online forms for submission of Contributor License Agreements that govern contributions to an OASIS Open Repository. These include the required Individual CLA for any individual contributor, and the optional Entity CLA.

As documented in the Open Repositories FAQ and below, a contribution to an OASIS Open Repository is distinct from any formal Contribution made to an OASIS Technical Committee. Contributions to OASIS TCs are governed by the OASIS Bylaws, OASIS TC Process, IPR Policy, and related policies. Contributor License Agreements (CLAs) described here apply only to Open Repositories.

Individual CLA: In order to contribute intellectual property into an OASIS Open Repository, you must agree to be bound by the terms of an Open Repository Contributor License Agreement (CLA), so that it is clear what terms apply to your intellectual property contributions. This is a license by you as an individual, for your protection as a contributor as well as for the protection of OASIS Open and all who use the donated material. You are required to agree to this CLA before you contribute to an OASIS Open Repository.

Entity CLA: For a corporation, organization or other entity that has assigned employees or contractors to contribute to an OASIS Open Repository, an Entity CLA is available for contributing intellectual property via that entity, that may have been assigned as part of an employment or contractor agreement. If an individual wishes to make contributions on behalf of an organization, then the organization also has an option to complete an Entity CLA, if the organization deems that relevant to its business practices. However, the signing of an Entity CLA does not remove the need for every developer or contributor to sign their own CLA as an individual, to cover any contributions not owned by the entity signing the Entity CLA.

Contributor License Agreement Forms

OASIS Open Repository CLAs on File

Updating and Terminating a CLA

The Contributor License Agreements specify conditions under which any CLA would require update. An Individual or Entity CLA can be updated or terminated at any time by sending an appropriate email message to repository-cla@oasis-open.org.

Contributions to an Open Repository versus to a Technical Committee

Contribution: A "contribution" to an OASIS Open Repository refers to content merged into the code repository, following the GitHub definition of contributor: "someone who has contributed to a project by having a pull request merged but does not have collaborator [i.e., direct write] access." Anyone who signs the Open Repository Individual Contributor License Agreement (CLA), signifying agreement with the licensing requirement, may contribute substantive content — subject to evaluation of a GitHub pull request. The main web page any Open Repository displays a link to a document listing contributions to the repository's default branch (filtered by Commits, Additions, and Deletions).

Public Feedback: An OASIS Open Repository, as with GitHub public repositories generally, also accepts public feedback from any GitHub user. Public feedback includes opening issues, authoring and editing comments, participating in conversations, making wiki edits, creating repository stars, and making suggestions via pull requests. Such feedback does not constitute an OASIS Open Repository contribution. However, as noted in the Guidelines: technical content intended as a substantive contribution (repository "code") to an Open Repository is subject to evaluation, and requires a signed Individual CLA.

Information about CLAs in the FAQ Document

Contact

Please send any feedback or questions to Open Repository Administration at repository-admin@oasis-open.org.

Testimonials

Cybersecurity is one of the greatest challenges our modern society faces and requires a coordinated approach to succeed. Under OASIS leadership, we see an opportunity to better organize the good guys to fight cybercriminals by sharing cyber threat intelligence data in an automated and efficient data standard.

Peter Allor

Senior Security Strategist

IBM

OASIS TC members act like extra QA resources for one another. We put our products together and shake out incompatibility issues. Finding those before we ship is invaluable.

Jay Brown

Senior Software Engineer

IBM

One thing that makes OASIS stand out is its openness. It’s not just that the standards are open and freely available in perpetuity, but also that the whole process is open.

Peter Brown

Independent Consultant

As a Sponsor of the OASIS CTI Technical Committee, we are delighted to be at the forefront of advancing critically important standards like STIX, TAXII and CybOX. By creating protocols that address how to best model, analyze, and share cyber threat intelligence, we can provide greater support to overwhelmed security professionals.

John Bruce

Chairman and CEO

Resilient Systems

Soltra is proud to be a member of the OASIS CTI Technical Committee. Our threat information sharing solution, Soltra Edge, was built leveraging STIX, TAXII, and Cybox – key standards within the industry. We look forward to contributing to CTI as we continue to establish and maintain open standards, while improving cyber security capabilities and reducing workload.

Aharon Chernin

CTO

Soltra, a DTCC and FS-ISAC Company

Open standards and community sharing are vital components of a successful and effective fight against cybercrime. Our goal is to make Threat Intelligence, from a variety of sources, timely and actionable.

Dorit Dor

VP, Products

Check Point

Focusing on standardizing threat intelligence technologies to keep sensitive government and corporate information secure is paramount to the mission of OASIS and its members. At ViaSat, we take a comprehensive approach to cybersecurity, from identifying potential cyber and physical security vulnerabilities to designing and implementing a plan that leverages big data analytics, intuitive visualization and intelligent automation to keep pace with evolving threats no matter where data resides on the network or how it is accessed.

Jerry Goodwin

VP, Secure Network Systems

ViaSat

iSIGHT Partners, creator of the commercial cyber threat intelligence category, understands how security organizations can gain the advantage over adversaries by using threat intelligence across their security and risk management program. As an early contributor and enabler of STIX, we welcome the opportunity to join with OASIS to further develop CTI standards and accelerate the adoption of context rich threat intelligence.

Robert Huber

VP Community

iSight Partners

At OASIS, you don't have to be a large vendor to influence work. Of all the standards bodies we’ve participated in, OASIS is the only one we recommend with no hesitation. It is a group that simply works.

Tim Hudson

Technical Director

Cryptsoft Pty Ltd

We are proud to support the work OASIS is doing to advance their cybersecurity specifications and promote information sharing, a critical factor in today's security posture. By sharing details about malicious incidents quickly, not only between the public and private sectors, but across industry lines within the private sector as well, we can work together to better defend ourselves and stay ahead of the hackers.

Paul Kurtz

Founder and CEO

TruSTAR Technology

STIX and TAXII in particular are important initiatives towards next generation threat intelligence. Using the same terms, data streams, and threat modeling methods will help researchers, vendors, and law enforcement alike share information back and forth to stay abreast or even ahead of threat actor groups. We are pleased to contribute to this and more through OASIS.

Derek Manky

Global Security Strategist

Fortinet

We have long been committed to any advances that can better enable the sharing of threat intelligence among security professionals. Until now, organizations have been hampered by a lack of common standards and the tendency for security information to be siloed. We strongly support this important endeavor and look forward to contributing to the standardization being led by OASIS.

Paul Martini

CEO and Co-founder

iboss Cybersecurity

NEC is very pleased to be part of the CTI Technical Committee and continues to drive CTI adoption with industry partnerships to benefit customers. NEC believes that threat intelligence standards are crucial for proactively countering the cyber threat. We are excited about the formation of CTI TC and support its efforts through its contributing to and promotion of this global standard.

Kozo Matsuo

General Manager, Cyber Security Strategy Division

NEC Corporation

We have been advocates of STIX, TAXII and CybOx for some time. OASIS as an international standards checkpoint will undoubtedly improve threat intelligence sharing amongst partners by facilitating the exchange of computer-readable threat information.

David Maxwell

Director of Threat Intelligence

eSentire

OASIS strikes the right balance between the amount of structure you need for real standards and the amount of flexibility you need for cutting-edge innovation.

Drummond Reed

XDI.org

Development of an industry-wide standards framework for cyber threat intelligence is crucial for the information security industry to be able to define and share threats. New Context is a proud sponsor of OASIS and believes strongly in open and transparent standards frameworks development. We look forward to collaborating on the next standards for STIX, CybOX and TAXII.

Daniel Riedel

CEO

New Context

I always encourage vendors with products related to access control, security, or cloud computing to join the appropriate OASIS Technical Committees and contribute to the standards work. We all benefit that way.

John Tolbert

VP, Cybersecurity

Queralt

OASIS provides an auditable, transparent and justifiable process. It makes it easy for anyone to understand how the CAP-AU Profile was developed.

Greg Trott

CAP-AU Project Manager

Australia Attorney-General's Dept

OASIS members continue to amaze me by their deep knowledge of technology. I can ask a question on a TC call and get more valuable feedback in minutes than I would from spending days in a conference.

Pim van der Eijk

Owner

Sonnenglanz Consulting

OASIS gives me access to very high-level colleagues. Every TC meeting is like an intensive research seminar on a topic in our field.

Adam Wyner, Dr.

Research Associate

University of Liverpool

Contributor License Agreements

Information about CLAs in the FAQ Document

Contact

Connect with OASIS

Related links

Testimonials

Other sites: