Standardising open source management
Recent discussions at the Open Source Experience event indicate a shift in how businesses handle non-proprietary software. Digital sovereignty—the ability for an organisation to maintain control over its own data and technology without being tied to a single provider—is moving from a theoretical concept to a set of practical management rules.
For a small or medium business, this means the software you use to run your operations is being scrutinised more closely. The focus is now on creating measurable targets for migrating away from proprietary locks and ensuring that open-source tools meet the same security standards as paid products.
Security and maintenance metrics
One of the primary concerns for SMEs is the security of the software supply chain. Much of the software used today, including parts of Microsoft 365 and various web services, relies on open-source code maintained by third parties. New frameworks aim to standardise how this code is audited.
Organisations are developing metrics to track how quickly vulnerabilities are patched in open-source projects. This data will help business owners decide which software is safe to implement and which poses a long-term risk. It is no longer enough for software to be free or accessible; it must demonstrate a reliable history of updates and a clear path for future support.
Implications for UK procurement
While much of this work is currently being led by European bodies, the outcomes will likely influence UK procurement standards. Larger companies are increasingly requiring their smaller suppliers to provide a Software Bill of Materials (SBOM). This is a list of every component within the software you use or provide, intended to help manage security risks.
Businesses should prepare by documenting their software stack. This includes identifying where you use open-source operating systems, databases, or web tools. Understanding these dependencies now will make it easier to comply with future security regulations and procurement audits.