@inproceedings{cf401050c81d4535976dbd2e06e571b7,
title = "Open data standards for open source software risk management routines: An examination of SPDX",
abstract = "As the organizational use of open source software (OSS) increases, it requires the adjustment of organizational routines to manage new OSS risk. These routines may be influenced by community-developed open data standards to explicate, analyze, and report OSS risks. Open data standards are co-created in open communities for unifying the exchange of information. The SPDX{\textregistered} specification is such an open data standard to explicate and share OSS risk information. The development and subsequent adoption of SPDX raises the questions of how organizations make sense of SPDX when improving their own risk management routines, and of how a community benefits from the experiential knowledge that is contributed back by organizational adopters. To explore these questions, we conducted a single case, multi-component field study, connecting with members of organizations that employed SPDX. The results of this study contribute to understanding the development and adoption of open data standards within open source environments.",
keywords = "Case Study, Interviews, Open Source Software, Practice Theory, Risk Management, Routines, Standardization",
author = "Robin Gandhi and Matt Germonprez and Link, {Georg J.P.}",
note = "Publisher Copyright: {\textcopyright} 2018 Copyright is held by the owner/author(s).; 2018 ACM Conference on Supporting Groupwork, GROUP 2018 ; Conference date: 07-01-2018 Through 10-01-2018",
year = "2018",
month = jan,
day = "7",
doi = "10.1145/3148330.3148333",
language = "English (US)",
isbn = "9781450355629",
series = "Proceedings of the International ACM SIGGROUP Conference on Supporting Group Work",
publisher = "Association for Computing Machinery",
pages = "219--229",
booktitle = "GROUP 2018 - Proceedings of the 2018 ACM Conference on Supporting Groupwork",
}