OWASP Board Meeting — February 18, 2019

P&L Tom Pappas

• Budget is $88k net income
• Budget is $65k ahead
• Conference income for 2018 was above budget, however expenses were way over budget.
• 2018 AppSec US - profit $427k, budget was $545k
• 2018 AppSec EU - profit $89k, budget was $95k
• 2018 AppSec EU - numbers might change a bit since we have so more expenses
• 2018 - I have done a mini audit and I believed I have caught everything
• 2018 - Open items
  • VAT return
  • $17k - Martin is trying to help me identify. There is not enough information on the ING account to identify.
  • Vacation time for staff to be processed
• 2018 - Budget is a positive

Balance Sheet

• AR - the staff has worked hard on identifying the open invoices.
• They have been put in reserve for two reasons
  • acceptable for audit
  • I believe we can still chase down a few of them.
• They have been accounted for in bad debt.

Sherif - we have approximately $1 million in cash.

Martin - that does not include chapter and project budgets

Tom - We have approximately $130k in operating budget, which is about two months.

Owen - are we in line with the previous years

Tom - 2018 was a profit, but 2017 was a negative. In 2017 our budget was set up to be an investment year.

Owen - do you feel good about the $130k for the operating budget.

Tom - no, there should be a 6 month reserve. Hopefully with the changes Mike is putting in place we will reach that.

Martin - don’t forget we have 3 global events this year, which bring in income.

Sherif - how was 2016?

Tom - I don’t remember off hand but I can put together a P&L for the Board.

Tom will send report to the Board for 2014-2017

Mike McCamon

Does the Interim Executive Director have the same signatory authority as an Executive Director?

Motion: To grant the Interim Executive Director the same signatory authority as an Executive Director (Martin Knobloch motions, Owen Pendlebury seconds)

Vote

Gary Robinson - Yes Ofer Maor - Yes Owen Pendlebury - Yes Richard Greenberg - Yes Sherif Mansour - Yes Martin Knobloch - Yes Chenxi Wang - Yes

Mike - should I proceed with the registered trademark for:

• OWASP
• Open Web Application Security Project
• Global AppSec
• AppSec Days

The proposal is for estimated $60k, budgeting $70k. Includes United States, Europe Union and United Kingdom

Owen - European Union cover UK?

Mike - does not but not after Brexit

Richard - do we need to it all now

Owen - if we do some now and some later, will the price be the same.

Mike - I believe so

Sherif - I believe this proposal to be extremely expensive

Ofer - I did this before and did not cost half the price

Mike - I can submit you the proposal, which includes trademark and logos.

Ofer - the funds to use for search is really not worth because we are not going to change the name

Owen - can we use an European lawyer to get another quote

Mike - I have no problem with that

Sherif - if we remove the search funds, how much will the price go down

Mike - I will have to review

Sherif - what is the timeline

Mike - I feel this is urgent

Motion: to enable the Interim Executive Director to proceed with the registered trademarks effort with a cap of $75k and to look for another lower offer and for lawyers in Europe. Exclude United Kingdom if the cost will not be more to add it later and exclude an extensive search. (Martin Knobloch motions, Owen Pendlebury seconds).

Chenxi Wang - Yes Gary Robinson - Yes Ofer Maor - abstain Owen Pendlebury - Yes Richard Greenberg - Yes Sherif Mansour - Yes Martin Knobloch - Yes

Mike - Direct staff to implement an Attributed Giving policy that restricts donations and membership dues splits to gifts more than $25,000. This policy will, as soon as is practically possible, sunset the practice of allowing membership dues being allocated to chapters and projects.

Reasons why:

• The amount of time staff spends on a $50 donation
• The risk to the US tax laws

Risk - if someone donates $10 to the Top Ten, by tax law you can only spend it on Top 10.

Ofer - I think $25k is too high. I would change the number to $1k to start with.

Richard - the main drive is the amount of overhead for such small amounts

Sherif - I agree with Ofer. I think lower number is the best for sponsors.

Owen - can we do some research to see if a company cares regarding the amount.

Mike - the only issue is if a sponsor declines if the number is too high and does not sponsor.

Richard - does this apply if a Chapter/Project wants to donate.

Mike - no because they are not a legal entity.

Martin - review how many chapters/projects have donate buttons on their page. Also we have to research when there is a project drive and people are thinking they are donating for that certain budget.

Sherif - I believe the buttons all link to the main donating page.

Richard - can review the donation amounts in history, so we can review the cap number.

Martin - I believe we need more input to move forward on this topic.

Ofer - transferring funds among through projects and chapters

Tom - the CPA determined that the chapters and projects are not legal entities, so the donated funds are unrestricted, but that is not a legal answer. I believe it should be $5k and more.

Mike - skip number 4 due to lack of time

Mike - Authorize the Executive Director to execute an agreement with the Marriott Wadman Park hotel in Washington, D.C. for a total fiscal commitment of no more than $430,000 to host Global AppSec DC being held the week of September 9, 2019. Motion: to approve the execute an agreement with the Marriott Wadman Park Hotel in Washington, DC for Global AppSec DC 2019 being held the week of September 9, 2019.

Vote Chenxi Wang - Yes Gary Robinson - Yes Ofer Maor - Yes Owen Pendlebury - Yes Richard - Yes Sherif Mansour - Yes Martin Knobloch - Yes

Martin - please review the budget submitted, so we can vote at the next meeting.