Although open source is freely downloadable, each open source project comes with an open source license that governs the conditions of use. In fact, there are over 50 OSI-approved open source licenses, thousands of variations on those licenses and a huge number of unapproved one-off open source licenses. Although much discussion of open source licensing revolves around the GPL licenses, other licenses are much more common in open source software used by enterprises.

Unlike with commercial software, you have to research which license applies to downloaded open source software. In many cases there may be multiple licenses because of bundled code, and often the licenses are not clearly enumerated. Rather, it requires due diligence to uncover all that apply. In addition, some licenses may have conflicting obligations, even if they serve components of a single application.

Once you know what open source tools you have, you need to define and implement policies that govern their use. These policies should define the parameters and rules under which your organization will select, use and manage open source, including requirements for certification or support of open source, what licenses are acceptable, the processes and criteria by which open source may be approved, and guidelines for interaction with the community. For example, a policy might define whitelists of pre-approved open source tools, blacklists of forbidden open source tools as well as conditions under which greylist open source packages may be used.

Managing license approvals can range from a simple e-mail process declaring what is being used to something more sophisticated. What's important is to have a history of what's being used, where it's being used and what's been approved. As these approval processes are implemented and automated, they will become part of the standard development practices.

One thing you want to end up with is a complete audit trail of open source tools. If there's no record of what software is installed, then hunting down this history becomes much more difficult and expensive when a legal or production issue arises.