Clearly, as the quote from Gartner VP Mark Driver indicates, IT organizations have to put policies in place to move open source use from invisible to visible so that they can be sure they have addressed the risks associated with open source (and, I might add, to also ensure they can achieve the many benefits that open source offers).

I would go even further than that. Unless policies are tied into organizational processes, it's difficult to impossible to know whether the policies are being observed. The critical thing is to marry policy with process and integrate open source management into overall IT processes. Only then can you be sure that the organization is using open source appropriately. Of course, as the quote concludes, hardly any IT organization has got open source governance in place.

It might seem daunting to try and figure out how to move forward with implementing open source governance. Where to start? How to know if you've identified all the open source currently running in your infrastructure? How to ensure you're complying with open source license conditions? Well, one way to start is to do some Internet searching on the topic. If that seems too ... random, let me offer another way to learn. I've written a whitepaper outlining how to move from ad hoc open source use to a full integration of open source use within existing IT processes. If you send me an email at bgolden (at) navicasoft.com, I'll be glad to forward a copy to you.

No matter how you decide to find out more about open source governance, it's critical you do so -- and soon. Otherwise, you run the risk of being in the shoes of the CIO described in Schwartz's anecdote: unaware of what software you're responsible for, and potentially liable for serious hurt.