norxs has self-certified its open source program against two international standards published through the OpenChain Project: ISO/IEC 5230:2020 for open source license compliance, and ISO/IEC 18974:2023 for open source security assurance.
The decision to go through OpenChain conformance wasn't really a decision — it's closer to formalizing something we were already doing. Nearly every embedded software stack we deliver, whether it's sitting in an EV powertrain controller or an industrial power distribution unit, has open source somewhere in it. TCP/IP stacks, RTOS kernels, crypto libraries: vendoring all of that from scratch isn't realistic, and pretending otherwise doesn't serve anyone. What ISO 26262, ISO/SAE 21434, and UN R155 increasingly expect is that you can say, precisely, what's in there, under what license, and who's watching it for known vulnerabilities. Conformance just makes that expectation auditable instead of implicit.
The two standards split cleanly. ISO/IEC 5230 is the license side: someone is explicitly responsible for open source compliance, staff are trained on it, and there's a repeatable process for clearing the obligations attached to whatever gets pulled in, not a one-time legal review before a release. ISO/IEC 18974 is the security side: a working process for tracking known vulnerabilities in the open source components you ship, not a spreadsheet somebody updates when they remember to.
For clients building to ISO/SAE 21434 and UN R155, the 18974 side matters at least as much as the 5230 side. Those standards expect suppliers to manage cyber risk across the software supply chain, not just the code they wrote themselves. Self-certifying against an external, community-maintained standard is a more credible way to demonstrate that than an internal policy document nobody outside the company has ever read.
norxs joins a short list of organizations that have gone through this — Toyota and Volvo Cars among them — and the practice sits alongside the NIST Cybersecurity Framework as part of how we handle security for the software we build.