What is an open source maturity model?

An open source maturity model is a framework for assessing the maturity of open source practices within an organization. The model provides guidelines for understanding an organization's proficiency in discovering, using, contributing to, and managing open source software.

The idea of a "maturity model" comes from the field of software engineering, where it's used to describe the capability of an organization's practices, processes, and methods in a certain discipline. The more mature an organization is, the more effective it should be at carrying out these practices.

Levels of open source maturity

For open source specifically, maturity models can range from basic stages of awareness and tactical use, to strategic use and contribution, and ultimately to open source leadership. For OSPOs, it is helpful to identify the maturity level of your organization according to the primary activities undertaken by the open source team.

Level 0: Developing awareness

An organization at level zero uses open source software but lacks formal processes and policies for managing it. In many cases, executives may not realize the extent to which their products or processes depend on open source.

For organizations at this level, having any sort of organized open source program is rare. It is more likely that one or more engineers take it upon themselves to identify the use of open source and to advocate for compliance.

Level 1: Compliance

An organization at level one understands that it uses open source and it understands the need for basic compliance. The organization might contribute back to the open source community occasionally, but not systematically.

At this level, the organization's engagement with open source is almost entirely tactical. Managing open source is seen as a risk management issue and it might be treated as a cost center. An organization at this level usually is centered out of the legal department, and is one responsibility layered on to the team.

Level 2: Contribution

An organization at level two has started to understand that engaging with outside communities as part of the open source process can create leverage that would not otherwise be possible.

Organizations at this level usually start to have formal OSPOs, even if they are small. The organization recognizes the strategic benefits of open source, contributes back to the open source community regularly, and has formal processes in place for managing its use of open source software. It may also start to identify opportunities to use open source to support innovation and find competitive advantages.

Level 3: Strategic leadership

An organization at level three recognizes that open source is part of its overall technical and IP portfolio. It uses open source strategically for business innovation and to support the bottom line.

Organizations at level three frequently employ recognized leaders in the open source community - and the organization itself may have a positive community reputation. These organizations usually drive the development of open source projects and have a strong culture of open source contribution.

The OSPO at level three is a strategic coordinator with groups across the business. A good indication that an organization is at level three is when it is able to identify specific ROI for its open source activities.

Climbing the ladder

Open source maturity is a huge strategic benefit. Organizations at level three have the ability to do things that seem impossible to other similarly sized companies, because they have learned how to extend their work beyond their own employees.

But a warning - you can't just jump to level three. I have never seen a company jump even one level. Developing a powerful open source program requires developing firm foundations. Each level builds on the ones before. So regardless of where your company is, keep your eye on the ultimate destination, but set your goals according to where you are.