Transparency Policy - Revision history

Bil Corry: Added addtional exclusions, note about complying with court orders

2014-06-21T12:50:57Z

Added addtional exclusions, note about complying with court orders

Bil Corry: Added the whistleblower exception

2014-06-19T14:47:19Z

Added the whistleblower exception

Bil Corry: cleanup of links

2014-06-19T14:34:14Z

cleanup of links

Bil Corry: minor rewording of the policy violations section based on a suggestion from Josh Sokol

2014-06-19T14:32:45Z

minor rewording of the policy violations section based on a suggestion from Josh Sokol

Bil Corry: Created page

2014-06-19T10:08:17Z

Created page

New page

=Transparency Policy=

==Policy Status==
<blockquote>'''WORKING DRAFT''' - this is a working draft being discussed on the [[https://lists.owasp.org/mailman/listinfo/governance Governance List]]. When completed, this will be presented to the [[https://www.owasp.org/index.php/About_The_Open_Web_Application_Security_Project#2014_Global_Board_Members Board of Directors]] for adoption. Once accepted, this notice will be updated to reflect the the policy is binding on members.</blockquote>

=="O" is for Open: An introduction==

The "O" in OWASP is for "Open" - Section 1.03 of the [[https://www.owasp.org/images/9/92/April2014OWASPFoundationByLaws.pdf OWASP Bylaws]] defines the value "Open" to mean:

<blockquote> "Everything at OWASP is radically transparent from our finances to our code."</blockquote>

This raises the question, what does "radically transparent" mean? Is there anything that can't be disclosed to the membership and/or public?

This policy defines what is not allowed to be disclosed, either because of legal, ethical, or privacy obligations.

== Radical Transparency ==

OWASP is committed to making its governance, processes, and finances transparent, so that any outside observer can determine how decisions were considered and ultimately agreed upon. When and where possible, OWASP must provide transparency.

There are, however, certain areas where transparency cannot be provided, either because it violates a law, is unethical, or goes against the expectation of privacy. The rule of thumb for transparency is to default all information as public, or if it must be restricted, the mandate is to make it as widely available as possible.

Levels of information restriction:
# Public (most open)
# All OWASP members, staff, Board of Directors
# Some members and/or staff, Board of Directors
# Executive Director, Compliance Officer, Board of Directors
# Executive Director, Board of Directors
# Board of Directors (most restricted)

== Exclusions from Radical Transparency ==

In this section, an attempt is made to enumerate situations where OWASP cannot provide transparency. Note that this list is not exhaustive, and future situations where there is a question about transparency should use this as a guide.

{| border="1" cellspacing="0" cellpadding="5"
|-
! Exclusion
! Notes
|-
| Staff records as maintained for Human Resources purposes
| Restricted to just staff and BoD members with a legitimate need to access records. Must never be disclosed unless permission is given from the staff member that the record pertains to.
|-
| Information pertaining to legal action, or pending legal action
| Restricted to just staff and BoD members with a legitimate need to access information. Must never be disclosed publicly either before, during, or after the legal action unless permitted by legal counsel.
|}

== Policy Violations ==

All members must comply with this policy, or will be subject to [[https://www.owasp.org/index.php/Governance/Whistleblower_Policy disciplinary action]], including suspension or revocation of membership, and/or exclusion from OWASP events, email lists, or other such action as determined.

@@ Line 31: / Line 31: @@
 In this section, an attempt is made to enumerate situations where OWASP cannot provide transparency.  Note that this list is not exhaustive, and future situations where there is a question about transparency should use this as a guide.
 {| border="1" cellspacing="0" cellpadding="5"
@@ Line 38: / Line 40: @@
 |-
 | Staff records as maintained for Human Resources purposes
-| Restricted to just staff and BoD members with a legitimate need to access records.  Must never be disclosed unless permission is given from the staff member that the record pertains to.
+| Restricted to just staff and BoD members with a legitimate need to access the records.  Must never be disclosed unless permission is given from the staff member that the record pertains to.
 |-
 | Information pertaining to legal action, or pending legal action
@@ Line 45: / Line 47: @@
 | Information pertaining to a whistlerblower complaint, ethics complaint, or similar, including the allegation, the investigation, and the outcome.
 | Restricted to just the Compliance officer, BoD members, Executive Director, and select staff when required.  Must never be disclosed publicly either before, during, or after the processing of the complaint via the [https://www.owasp.org/index.php/Governance/Whistleblower_Policy Whistlerblower policy].  Should the complaint be made public, then the Board of Directors may choose which information, if any, to release based on the situation and the best interest of the organization.
 |}

← Older revision		Revision as of 14:32, 19 June 2014
Line 46:		Line 46:
	== Policy Violations ==		== Policy Violations ==

−	All members must comply with this policy, or will be subject to [[https://www.owasp.org/index.php/Governance/Whistleblower_Policy disciplinary action]], including suspension or revocation of membership, ~~and/or~~ exclusion from OWASP events, email lists, or other such action as determined.	+	All members must comply with this policy, or will be subject to [[https://www.owasp.org/index.php/Governance/Whistleblower_Policy disciplinary action]], including the possibility of suspension or revocation of membership, exclusion from OWASP events and email lists, or other such action as determined.

@@ Line 42: / Line 42: @@
 | Information pertaining to legal action, or pending legal action
 | Restricted to just staff and BoD members with a legitimate need to access information.  Must never be disclosed publicly either before, during, or after the legal action unless permitted by legal counsel.
 |}

@@ Line 2: / Line 2: @@
 ==Policy Status==
-<blockquote>'''WORKING DRAFT''' - this is a working draft being discussed on the [[https://lists.owasp.org/mailman/listinfo/governance Governance List]].  When completed, this will be presented to the [[https://www.owasp.org/index.php/About_The_Open_Web_Application_Security_Project#2014_Global_Board_Members Board of Directors]] for adoption.  Once accepted, this notice will be updated to reflect the the policy is binding on members.</blockquote>
+<blockquote>'''WORKING DRAFT''' - this is a working draft being discussed on the [https://lists.owasp.org/mailman/listinfo/governance Governance List].  When completed, this will be presented to the [https://www.owasp.org/index.php/About_The_Open_Web_Application_Security_Project#2014_Global_Board_Members Board of Directors] for adoption.  Once accepted, this notice will be updated to reflect the the policy is binding on members.</blockquote>
 =="O" is for Open: An introduction==
-The "O" in OWASP is for "Open" - Section 1.03 of the [[https://www.owasp.org/images/9/92/April2014OWASPFoundationByLaws.pdf OWASP Bylaws]] defines the value "Open" to mean:
+The "O" in OWASP is for "Open" - Section 1.03 of the [https://www.owasp.org/images/9/92/April2014OWASPFoundationByLaws.pdf OWASP Bylaws] defines the value "Open" to mean:
 <blockquote> "Everything at OWASP is radically transparent from our finances to our code."</blockquote>
@@ Line 46: / Line 46: @@
 == Policy Violations ==
-All members must comply with this policy, or will be subject to [[https://www.owasp.org/index.php/Governance/Whistleblower_Policy disciplinary action]], including the possibility of suspension or revocation of membership, exclusion from OWASP events and email lists, or other such action as determined.
+All members must comply with this policy, or will be subject to [https://www.owasp.org/index.php/Governance/Whistleblower_Policy disciplinary action], including the possibility of suspension or revocation of membership, exclusion from OWASP events and email lists, or other such action as determined.