202310 October 2023 Board Meeting

### Overview The October 2023 OWASP Board Meeting covered a range of organizational, operational, and governance topics. Key agenda items included administrative updates on the ongoing financial audit and accounting transition, the 2023 board election voter turnout, operational status of chapters and projects, logistical preparations for Global AppSec DC and Singapore, the appointment of a new compliance committee member, and policy enforcement around corporate sponsor advertising on official social media channels.

### Key Topics - **Finance, Audit, and Accounting Transition**: Executive Director Andrew reported on the status of the 2022 990 audit, noting requisitions handled with Virtual and upcoming review meetings. Due to revised methodologies, documentation of expense management controls, and updated tax treatment for corporate memberships, Andrew noted OWASP might not see a completely clean audit report. The operational migration to Charity CFO was ongoing, awaiting the audit conclusion, while banking operations were transitioning between Citizens and Chase. - **Elections and Membership Metrics**: Dawn reported board election participation was at approximately 7.8%, tracking in line with historical turnouts under 15%. Andrew noted active membership was at 6,423. It was highlighted that a majority of project and chapter leaders were not active paid members, prompting discussion of complimentary leader membership drives. Technology updates included a force majeure flag extending complimentary memberships to individuals in conflict zones (specifically Ukraine, Israel, and Palestine). - **Project Committee Report**: Björn presented an update on the project review process, handbook revisions, and project exits. Recent adjustments allow continuous monthly promotion reviews via a Google Form. Harold was leading the rewrite of the Project Leader Handbook to serve as a comprehensive single source of truth for guidelines, funding, and Jira reimbursement procedures (including the simplified process for expenses under $250). The board discussed project departures (such as ZAP and SKF), legal IP/licensing ownership, and repository management across GitHub organizations. - **Compliance Committee Appointment**: The board met candidate Ricardo "Rick" Melo for the compliance committee (transitioning to compliance officers as of January 1). Rick shared his professional background spanning 22 years in IT, banking cyber risk, and management. Former compliance committee members Bill and Ricardo shared insights into adjudicating interpersonal and code-of-conduct disputes impartially. The board unanimously approved a motion appointing Rick to the compliance committee contingent upon completing his OWASP membership. - **Events and Social Media Guidelines**: Lauren reported that Global AppSec DC exceeded budget expectations across registrations ($400,000+), trainings ($100,000 over budget), and sponsorships. Schedule adjustments were made to accommodate remote participation for speakers affected by international events and visa issues. Lauren also confirmed Global AppSec Singapore concluded with a net profit over $3,500. Finally, the board reviewed corporate sponsorship social media policies, clarifying that benefits had been revised back to single welcome announcements to prevent vendors from posting commercial product marketing or derogatory project comparisons via OWASP channels.

### Technical Details - **Project Promotions & Governance**: Project promotions now follow a structured review sheet evaluated by committee members (Pass, Fail, Provisional Pass). Six to seven projects had reached the newly established production level. Formal flagship status additions or revocations remain subject to board approval upon committee recommendation. - **Social Media Contract Controls**: Previous corporate sponsorship packages permitted one to three monthly posts, leading to an incident where an external post promoted a commercial product at the expense of an OWASP project. Contracts have been revised, and active grandfathered posts are strictly prescreened by staff to ensure vendor neutrality.

### Takeaways OWASP demonstrated strong operational performance in events and operating reserves, while working through governance transitions in financial reporting, project IP policies, and compliance oversight. The board emphasized enforcing vendor neutrality on communication channels and improving internal documentation to make resources accessible to community leaders.