Research shows that enterprise software teams are twice as productive when they contribute to open source projects compared to teams who only consume open source code. Like every community, open source projects have unique ways of working—including a few important things to know before you start building.

## Getting to know the open source community

- Look through your software stack for open source code and identify the project it originated from.
- Find that project’s primary community (website, forum, or repository, for example) and try to get an understanding of their goals and future roadmap.
- Read the project’s README and CONTRIBUTING files for guidance on how to participate effectively.

## Supporting open source projects
- Explore open source projects in your preferred programming language; look for projects that both interest you and align with your organization’s strategy.
- Review your business’s open source investments and pick the most critical projects to support, which could include contributing time, effort, or
even financial assistance.

## Creating your own open source projects

- Identify non-proprietary, non-business-critical software your company has developed that could benefit the greater community as open source.
- Create and share your open source projects on GitHub.
- Announce your open source projects through your usual public-facing channels and in any open source communities that might find them interesting.

## Collaborating on GitHub

- Subscribe to repository notifications to stay up to date on changes.
- Read and comment on issues, or open a new one when you have something helpful to offer.
- If you have solutions to problems posed by the community, suggest them with pull requests.
- If you’ve made local improvements to open source code, contribute them back upstream to their source projects.
- Use the “-on-behalf-of” commit tag when contributing back to open source projects to indicate your organization’s support.
- Standardize your open source library usage as much as possible for easier maintenance and reduced exposure to vulnerable code.

When your team uses open source software (OSS), everyone benefits, but how much is up to you.

Resource Page for /open-source/enterprise-checklist-open-source-communities

The enterprise checklist for building with open source communities


For high-performing organizations, that means open source software is now a “when,” not an “if.”

In this IDC report, you’ll learn how open source code and communities drive digital transformation. You’ll also learn how GitHub can help your business use open source securely and adopt best practices like peer reviews, transparency, and collaboration that can move your software forward.


Today, every company is a software company. Staying competitive depends on how fast your business can transform—and embrace new tools and technology.

Resource Page for /open-source/enterprise-innovation

IDC report: How open source is the key to innovation in the enterprise


Just as Microsoft Corp.’s acquisition of GitHub solidified the code-hosting service’s place in the software development world, GitHub’s recent announcement that its Enterprise Cloud has achieved FedRAMP authorization delivers, for the first time, a way for government agencies to securely participate in the entire open source development universe.

Traditionally, federal users have leveraged GitHub’s team plan or GitHub Enterprise Server platform by hosting it on-premises or in their own private cloud. GitHub Enterprise Cloud, which resides entirely in the cloud, has been available for the past year. It offers the ability to use single sign-on and a secondary identity provider (including government PIV and CAC cards) and includes expanded support and service level agreements.

“We have historically had [government] customers on GitHub.com, but they were either doing it as shadow IT under a team plan or non-mission critical systems. Because GitHub.com did not have an ATO [authority to operate] it was never deemed appropriate for most organizations’ day-to-day mission-critical applications,” said Jamie Jones, GitHub principal architect.

That changed in October, with GitHub achieving FedRAMP operating authority under a relatively new process called FedRAMP Tailored, which provides a more streamlined security approval process that is better suited for softwareas-a-service providers such as GitHub. “We’re now giving them a place where they can do this in the cloud on GitHub managed and hosted hardware,” said Jones.

The features on GitHub Enterprise Cloud are quickly gaining parity with, and in some cases exceeding, the features of GitHub’s Enterprise Server, its on-premises offering. But the big advantage of switching to GitHub Enterprise Cloud is it will give agencies of all sizes access to the entire GitHub universe of open source development and collaboration resources — and the vast community of developers contributing to those resources.

> We’re now giving them a place where they can do this in the cloud on GitHub managed and hosted hardware

<small>- Jamie Jones</small>

“In the average software product developed today, more than 57 percent of the code within it is actually open source or code that comes from other projects,” said Jones. “It’s become critical for modern software to be able to collaborate with the open source marketplace.”

And the size of that marketplace is mind-boggling. At its most recent annual user and developer conference, GitHub announced it has more than 31 million users currently on GitHub.com. Now, agencies that were once confined to operating within an enterprise GitHub community (anywhere from a handful to a few thousand developers) have access to a much larger code base and talent pool.

Governments all over the world are using GitHub. At last count, 143 U.S. federal civilian agencies, 14 Department of Defense agencies and 48 state agencies were leveraging GitHub to collaborate on code, data, policy and procurement, according to GitHub figures. In addition to the platform’s 31 million users, the number of organizations on it has jumped 40 percent to 2.1 million, as has the number of code repositories, which now stands at more than 100 million.

> At last count, 143 U.S. federal civilian agencies, 14 Department of Defense agencies and 48 state agencies were leveraging GitHub to collaborate on code, data, policy and procurement

<small>- Jamie Jones</small>

## FedRAMP Tailored

GitHub is among the first cloud service providers to take advantage of FedRAMP Tailored. FedRAMP was originally aimed at helping agencies certify that a cloud computing service met a long list of federally mandated security controls. The idea was that other agencies, once certified, could adopt that same service without repeating the same certification process. But the process was time-consuming, expensive and targeted initially toward infrastructure-asa-service (IaaS) and platform-as-a-service (PaaS) providers — in other words, the traditional large cloud providers like AWS, Google, IBM, Microsoft and others.

The FedRAMP Program Office within the General Service Administration, however, recognized an opportunity to finetune FedRAMP specifically for software-as-a-service (SaaS) providers that handle low-risk, low-impact data and aren’t responsible for a host of network security controls.

According to Ashley Mahan, acting director of the FedRAMP Program Office, the FedRAMP Tailored assessment process focuses only on a subset of the NIST 800-53 technical controls and places a greater focus on policies, procedures and training surrounding the management and use of public or non-sensitive data.

“What that does is it affords for a fast and efficient authorization process that lessens a vendor’s time to market and really speeds up the timelines on when an agency can make use of these innovative cloud technologies,” Mahan said.

That put the economics of FedRAMP operating authority within reach for GitHub for the first time, according to Jones. But it also opens the door for agencies to work with a wider range of software-as-a-service providers.

“FedRAMP Tailored was really developed as a way for SaaS solutions, such as GitHub, to get a FedRAMP authorization so that they could be easily consumed by the federal government while taking into account the appropriate security these systems require, as opposed to the traditional cloud providers,” said Jones.

Agencies can now simply go to the FedRAMP marketplace and pull down the authorization to begin using the platform with confidence that it meets the baseline security requirements established by the government for SaaS. “For some agencies it can reduce the time it takes to receive an ATO to mere minutes,” said Jones.

> One key benefit of using the FedRAMPauthorized Enterprise Cloud is we can now support your agency’s identification and authorization tools

<small>- Jamie Jones</small>

## The Business case

According to Jones, there is no reason for an agency that is currently using GitHub under a team or enterprise license not to move up to the FedRAMP-authorized Enterprise Cloud version — and in most circumstances, there are a number of advantages.

“One key benefit of using the FedRAMP-authorized Enterprise Cloud is we can now support your agency’s identification and authorization tools,” he said. “For the extra capabilities we are providing, including faster support requests or the ability to use SAML and your external identity providers, it’s far less of an administrative burden,” said Jones.

The FedRAMP-authorized GitHub Enterprise Cloud also offers enhanced security services and features that are not yet available for Enterprise customers.

For example, GitHub recently rolled out a vulnerability alert service. It began last year through a collaboration with the National Vulnerability Database to provide alerts directly through the FedRAMP-authorized GitHub Enterprise Cloud for vulnerabilities in Ruby, JavaScript, Python, Java and .Net. GitHub has identified more than 4 million vulnerable dependencies and has resolved more than 1 million of those during the past year.

If GitHub finds that you are using a library with a known vulnerability, the alert service will flag it for you and alert the repository administrators. GitHub will even alert the developers to potential upgrades that are known to fix the vulnerability, said Jones.

Offering increased security and vulnerability protections will translate into enhanced business speed for government agencies, according to Jones.

“We’ve all heard stories about how when government staff or contractors get hired and it’s days or weeks before they have access to the proper hardware and systems to even start working on their jobs. But by being able to access GitHub from the Internet, rather than behind an agency firewall, and still be able to use it in a secure and compliant way, this should allow agency users to get up to speed and working faster,” he said.

“Traditionally, we’ve seen great uptake in use of GitHub Enterprise Server, which is the on-premises version of GitHub,” Jones said. “But we’re hoping that the FedRAMP authorization for Enterprise Cloud will really allow our federal customers to take advantage of SaaS and GitHub running on the internet and in the cloud.”

> Making the move from GitHub Enterprise Server to the GitHub Enterprise Cloud happens seamlessly behind the scenes

<small>- Jamie Jones</small>

Making the move from GitHub Enterprise Server to the GitHub Enterprise Cloud “happens seamlessly behind the scenes,” said Jones. “As you move over to Enterprise Cloud, the key advantage is you’re able to move a lot of the infrastructure and workload into the cloud, which helps you meet the cloud-first mandate,” he said.



By achieving FedRAMP operating authority, GitHub’s Enterprise Cloud allows federal users to collaborate with millions of open source software developers.

Resource Page for /open-source/federal-access-open-source

Federal access to open source with GitHub

[Microsoft FOSS Fund](https://github.com/microsoft/foss-fund) is one of the many ways the company supports the open source ecosystem that we all depend upon for so much. Every quarter the company's FOSS Fund typically awards $30,000 USD split across 1-5 projects in order of most-voted. Past recipients include [LLVM](https://llvm.org/), [Debian](https://www.debian.org/), [serde](https://github.com/SparcLab/OpenSERDES), [YAML](https://yaml.org/), [mermaid.js](https://mermaid.js.org/), and [NVDA (NonVisual Desktop Access)](https://www.nvaccess.org/). Projects have used the funding for everything from paying for security audits to hiring graphic designers to create logos.

In this article we'll explore:

-   How Microsoft taps employees to identify projects to fund

-   What you should consider when building your own open source funding program

Building bridges to the open source community
---------------------------------------------

The FOSS Fund, inspired by [Duane O'Brien](https://www.linkedin.com/in/duaneobrien/), was established by Microsoft's open source program office (OSPO) in 2019 and made its first sponsorships to open source projects in 2020.  Projects are identified through  employee nomination and voted on by employees who have contributed to open source in some way in the last few months. Microsoft is able to tap into the knowledge and passion employees have for their dependencies as both an opportunity to support those projects, but also to build awareness of impact, need and advocacy beyond any one project. Now Microsoft is one of many companies participating in the [FOSS Funders group](https://fossfunders.com/).

"Microsoft's FOSS Fund helps us build connections between Microsoft employees and open source communities," says Microsoft Open Source Programs Office Principal TPM Emma Irwin. "Being able to evaluate dependencies for sponsorship, contribution, or other opportunities is a competency like any other in engineering and has to be taught and practiced."

How Microsoft FOSS Fund works
-----------------------------

Any Microsoft employee can nominate a project used by Microsoft, but only employees who have contributed to open source in the last six months are eligible to vote on the winners. Around six thousand employees voted in the last round.

To be considered, a project must meet the following requirements:

-   Be used by Microsoft products and/or services.

-   Have an OSI-approved open source license.

-   Have a way to receive funds that our procurement and legal teams approve.

-   Have transparent governance about where and how funds are directed.

-   Not be owned, or primarily maintained by Microsoft employees.

Projects must have public facing details about how sponsorships are distributed, for example in the form of a FUNDING.yml file or in the GitHub Sponsors pane. The goal here is to ensure that the community is not surprised by the direction of funding.

Irwin says GitHub Sponsors is the preferred way to handle donations because it's already established as an accepted vendor, and makes it extremely easy to make payments. "We've heard from people at other companies that they prefer to use GitHub Sponsors when possible too," Irwin says. She emphasizes that while it's a preference, it is not a requirement: The Microsoft FOSS Fund has paid projects through fiscal sponsors like NumFocus, SFI, and other means.

Words of advice
---------------

Irwin says that other organizations looking to create their own funds for open source software should start by setting goals and identifying metrics that teach employees about their dependencies and ways of investing that actually help---be that contribution, sponsorship or beyond. "You need to think about, given your budget, how many different projects  you are able to sponsor and what metrics you should use to find them," Irwin says. "For example if you want to focus on sponsoring single maintainer projects even one sponsorship can make a huge difference and you might be able to do more of those."

Keep adjusting as you go. "Treat the whole process as a continual learning opportunity," she says. "Keep asking what problem or problems you're trying to solve and how the funding will help."

Irwin also emphasizes that investment in open source is a cycle, with no beginning or end - it's important to regularly evaluate the impact of  these efforts on the sustainability of your dependencies over time and to look for emerging needs. "FOSS Fund is a one-time award" she says. "Projects need ongoing contributions to be sustainable."

That means more companies stepping up to keep open source projects thriving, with upstream contributions and, yes, funding.

If you're ready to start sponsoring the open source projects you depend upon, or you're a maintainer looking for sponsorship, [sign-up for GitHub Sponsors today](https://github.com/sponsors).

Open source depends on the efforts of contributions from around the world. Millions of people pitch in to write code, provide support, draft documentation, plan events, and all the other tasks that keep projects moving.


Resource Page for /open-source/microsoft-foss-fund

How Microsoft’s FOSS fund supports the open source ecosystem


But while some enterprise teams use more open source software (OSS) than others, how you engage in OSS depends on your organization’s specific goals. Use this model to see how your team works with the open source community today—and where to go next.

![Infographic with five sections explaining the stages of engagement with open source software for a team](/assets/img/whitepapers/open-source-engagement-model.png)
[View Full Size](/assets/img/whitepapers/open-source-engagement-model.png)


Open source is changing the way we build software—with organizations using open source code, tools, and best practices to get applications to customers even faster.

Resource Page for /open-source/open-source-engagement-model-enterprise-software

Open source engagement model for enterprise software teams


In this guide, you’ll learn what makes up an open source enterprise and the three key factors your team needs to build securely with OSS. Find out how you can use OSS to experience rapid innovation, outpace competitors, and cut down costs—all while minimizing risk.

## The new way to build software

Nearly every industry today uses technology to differentiate their products and services. Software has become the great equalizer—allowing small companies with big ideas to challenge the status quo and compete against major corporations.

Developers turn to the open source community for the resources they need to build better software, faster. However, enterprises have been more cautious, typically limiting open source adoption to proven areas like operating systems (Linux) or programming frameworks such as Ruby or JavaScript.

> 59 percent of IT leaders plan to increase their use of open source code in the next year.

<small>“The State of Enterprise Open Source” 2019 report</small>

## How organizations make the change

Maximum innovation, minimal risk: that’s the goal of adopting open source. By adding an open source software (OSS) component to your project, you benefit from the work of potentially thousands of developers—and also take on the risk of consuming code you didn’t create. As you bring in more code from outside your development team, your skills and approach to building software must also change.

Change is hard. Most enterprises aren’t used to working with external communities or even working across their own organizational silos. The ones who embrace change and build balanced, secure relationships with the OSS community become a new type of organization: open source enterprises.

## What is an open source enterprise?

Open source enterprises are organizations that recognize OSS as essential, not optional, for modern software development. They engage in open source communities and keep up with the best and latest technology. Open source enterprises transform their businesses by strategically investing in open source with the help of a secure platform. As a result, these organizations experience rapid innovation, outpace competitors, and cut down costs—all while minimizing risk.

## Three factors that make an open source enterprise

### 1. Open source engagement

OSS is the product of thousands of contributors. Getting the most out of open source requires commitment and action. According to a recent study by Harvard Business School, companies who contribute to open source receive up to twice the benefit of those who just use open source code. Open source enterprises consume and adopt open source, but also contribute to and mentor the communities they depend on.

### 2. Innersource culture

Open source communities are transparent and collaborative, which increases diversity of thought and promotes the best ideas. Open source enterprises use these same principles with their teams internally—an approach known as “innersource.” By implementing open source practices in your organization, you optimize your workforce and increase your output.

### 3. Secure and compliant platform

Open source usage comes with risks, and teams need to know how to work safely with OSS suppliers. Understanding open source dependencies and their vulnerabilities can be the difference between being patched or hacked. Open source enterprises invest in the right platform and tools to manage code vulnerabilities and use open source securely.


How large organizations use open source to build better software, faster.

Resource Page for /open-source/quick-guide-to-open-source-enterprises

The quick guide to open source enterprises

Open source software is the essential building block for any modern software project. Consuming open source securely and contributing back to the community have invaluable benefits at individual and organizational levels.<br><br>Join our fireside chat with IAG, Woolworths and GitHub experts as we discuss the pillars of a successful open source strategy including DevOps and security.

Resource Page for /open-source/secure-devops

Fireside Chat: Unleash the power of open source securely

Landing Page for /open-source/what-is-an-open-source-program-office

/open-source/what-is-open-source-software

Ensuring those open source projects are healthy, secure, and well supported is a major priority for Stripe. It's not just the right thing to do: Investing in open source improves the company's bottom line. The company supports open source in many ways, from upstream contributions to projects they use to releasing their own open source projects to direct funding.

In 2020, the company scaled up their efforts and formalized their sponsorship program. Today, Stripe funds 11 different projects on a ongoing basis.

In this article we'll:

-   Learn how and why Stripe sponsors open source projects

-   Explore how you can measure the financial benefits of open source in your own organization

Beyond altruism: Why Stripe sponsors open source
------------------------------------------------

Fix credits the program's success on how tied it is to providing business value to Stripe as a company. "Our primary motivation was to invest in the open source software that our users depend on to run their businesses," says Fix. "We want all engineers at Stripe to have access to the best tools to get their jobs done."

The best way to build a sustainable funding program for open source projects, Stripe found, is a symbiotic approach of aligning the company's users' needs with those of maintainers. "Companies need to balance open source investment against everything else on their books, so it's essential to know that sponsorship is delivering value, directly or indirectly, for our users," Fix says.

How Stripe picks projects and distributes funds
-----------------------------------------------

The OSPO team at Stripe gathered usage statistics like API calls and package downloads to determine what open source projects were most important to the company, and consulted their own developers internally about what packages they use and which ones would benefit from investment. Then they talked directly with the maintainers of those packages about how they could best support them. "We really wanted to understand how much investment was required for developers to make conscious changes in their lives to spend more time maintaining their open source projects," Fix says. The Stripe OSPO team makes the final call on which projects to fund in cooperation with their CTO.

The main success criteria Stripe judges its sponsorship decisions against, is how well the projects are being maintained.

Stripe distributes funds via GitHub Sponsors and Open Collective. "These platforms are 'open source native'," Fix says. "It's where developers already are. Plus the platforms have a global reach, which is important since Stripe is sponsoring developers in 11 different countries thus far.

Fix encourages other organizations considering sponsorship programs to treat funding platforms like vendors. Putting them through a standard procurement process makes it easier for everyone across your organization to interact with them.

Measuring the financial benefits of open source in your organization
--------------------------------------------------------------------

Fix recommends that any organizations thinking about spinning up their own OSS sponsorship program first focus on connecting sponsorships to their organization's business goals, and measure the return on investment towards those goals.

In addition to measuring how much user value open source projects enable, Fix recommends a few other things to consider:

-   How much money does open source save your organization? How much time does open source save your developers?

-   Has an open source project, for example an integration or SDK, helped land a sale?

-   Has an open source project unblocked a launch?

One thing to keep in mind, however, is that cost savings can be one-off events, and it's best to look for ongoing benefits created by open source projects in order to create more sustainable funding programs.

"Identifying and tracking these benefits enables you to deploy the greatest amount of sponsorship dollars over the longest period of time," Fix says. "It's what's best both for your organization and the open source community."

Millions of companies around the world use Stripe to move trillions of US dollars. Stripe is a key part of the financial infrastructure of the internet. “Like so much of the internet, open source is a fundamental part of what we do at Stripe," explains engineer and Head of Open Source Mike Fix.