Liaisons

[David Keaton <dmk@dmk.com>]

     Because we had some questions during today's meeting, I thought I 
would let people know what liaisons are all about.

What is a liaison?
------------------

     A liaison is a relationship between two standards committees.  It 
is not the same as collaboration.  A liaison is a way for two standards 
committees to stay informed about each other's work.  If two committees 
have overlapping communities, having a liaison relationship can improve 
each committee's contact with and knowledge of its community.

     Other benefits of a liaison include avoiding duplication of effort 
between two committees, possibly establishing future collaboration 
projects (such as through a joint working group) if that becomes 
appropriate, and greater visibility between two related communities.

     If one committee in a liaison relationship has an upcoming 
decision to make, the other committee can also send a liaison statement 
giving its opinion, which might take things into account that had not 
occurred to the deciding committee.

How does it work?
-----------------

     A specific person is chosen as the liaison to the other committee, 
so that it is clear who is responsible for sending and receiving liaison 
reports.  It is also reasonable to have two or three people acting as 
liaison, though more than that is usually too many, because it dilutes 
the responsibility.

     Normally, a permanent agenda item is established for each liaison 
relationship.  During that agenda item, the person chosen as liaison 
reports what is happening in the other committee.  That person can also 
take a liaison statement back to the other committee, if there is 
something specific that needs to be said.

     A liaison report can be a formal written statement, or it can be 
an informal verbal update.

     If there is a person who is a member of both committees, and 
attends the meetings of both committees, that person is an ideal choice 
to be elected as the liaison.  If not, then a company or organization 
that attends both committees can supply a liaison person to each committee.

How do we decide whether to create a liaison?
---------------------------------------------

     Generally, both committees vote on whether to establish a liaison 
between the two.  If they both agree to do so, a liaison is established.

     A good liaison organization is one that operates in a related 
community, so that sharing information is desired and useful.

     Establishing liaisons is encouraged, so that information can be 
shared wherever it is appropriate.  At the same time, since each liaison 
relationship takes up agenda time in both committees, the relationship 
should only be established if it is sufficiently relevant.  A balance 
needs to be considered when deciding whether or not to initiate a liaison.

What does OASIS say about liaison procedures?
---------------------------------------------

     OASIS has guidelines for liaisons here.

https://www.oasis-open.org/policies-guidelines/liaison/#liaisons

Why are we considering a liaison with OpenSSF?
----------------------------------------------

     A member of the Open Source Security Foundation (OpenSSF) 
contacted OASIS to indicate that OpenSSF finds SARIF relevant to its 
work, and is interested in seeing if we would like to establish a 
liaison with them.

     Further information about OpenSSF is here.

https://openssf.org/

Where do we go from here?
-------------------------

     At the SARIF TC meeting on May 5, we will vote on whether or not 
to establish a liaison relationship with OpenSSF.  If we vote in favor, 
we will also vote to choose a person (or a very small group) who will be 
responsible for the liaison.

     Please feel free to discuss on the mailing list, and let me know 
if you have any additional questions.

					David