April 2021 Minutes

Background Given the confused and unclear state of the membership list(s), the recently uncovered corner case where membership status was not correctly communicated, and the uncertainty (of whether one's membership is in good standing or not, whether one can stand for the Board, vote in the elections, or participate as an OWASP leader) attached to that I would like to propose the following motions:

Motion "Resolved, that up until the week before the 2022 Board election being called, any member affected any of the following conditions:

• The lack of notification for renewal failing to be sent by the Foundation (for example, as described to the Board during the March public board call);
• The membership renewal service not being operational during an attempt to renew within 24 hours of expiration, and the member then informed the Foundation of this fact; or
• A Foundation-side operation issue which recorded a membership as having expired when it had not

be given one week to correct their membership status from the moment the Foundation informs them of their lapse, and for their membership to be considered uninterrupted for the duration for all intents and purposes."

• Sponsor: Grant Ongers
• Second: Joubin Jabbari

Vote: https://doodle.com/poll/edsnp34mgxzu6sqn

Sherif Mansour:  Yes
Vandana Verma:   Abstain
Bil Corry:       Yes
Grant Ongers:    Yes
Owen Pendlebury: Yes
Martin Knobloch: Yes
Joubin Jabbari:  Yes

Vote passes six yes, one abstain.

Background: Given the confused and unclear state of the membership list(s), the recently uncovered corner case where membership status was not correctly communicated, and the uncertainty (of whether one's membership is in good standing or not, whether one can stand for the Board, vote in the elections, or participate as an OWASP leader) attached to that I would like to propose the following motions:

Subsidiary Motion: "Resolved, that the combined unique individuals across the three current sources of membership information (the Foundation's Copper CRM; mailing list, MailChimp; and automated payment system, Stripe) for whom an expectation of active membership exists, be considered fully qualified members in good standing as of the 1st of June 2021. These three lists are merged into a single source of truth. Any cases of doubt (around the validity of membership or remaining duration of membership) be resolved in favor of the member concerned.

• Sponsor: Grant Ongers
• Second: Joubin Jabbari

Vote: https://doodle.com/poll/isbaqbgrd7grzkch

Sherif Mansour:  Yes
Vandana Verma:   Abstain
Bil Corry:       Yes
Grant Ongers:    Yes
Owen Pendlebury: Yes
Martin Knobloch: Yes
Joubin Jabbari:  Yes

Vote passes six yes, one abstain.

KPI             April       Delta
Members         3818        0.03%
Visitors        3.9m        79%     (now using CloudFlare numbers)
OSD SLA met     33.4%       -66%    (clearing out backlog)
NSFR SLA met    91.1%       -5.89%  (clearing out backlog)
YTD net income  ($13.4k)    $96.5k  better than YTD budget
Cash assets     $1,332,401  $205.3k better than YTD budget

• March 2021 Financial Package

This has been a busy month for the Foundation. We have completed several projects, and many other things besides. I look forward to seeing the merchandise store go live soon, which will allow members to assist us in fundraising, although likely in very small amounts. Our costs are not as large as expected so far, but we will be keeping a close eye on it before opening it up to all designs.

I am moving our KPI reporting to be mission centric. This may be the last month you see any reporting of our website traffic, as it's operational in nature and a weak indicator of engagement. We need to better report on the health of our finances, projects, chapters, and events, as well as total social engagement. For now, I report the values from Cloud Flare, which is a more accurate statement of our website traffic, and I've changed across to reporting our membership data from an internal tool developed by Harold that uses Stripe, which is the most accurate membership record we have.

For the first time in a long time, we reviewed our Director and Officer's insurance. We renewed, upping the limit from $USD 1m to $USD 2m. Although this was a bit more than budgeted for, it's well worth the piece of mind. We have not upped our coverage in many years. There was a small price increase for other things, but I am glad we did not have to go out to market, because COVID has made some forms of insurance extremely expensive or unobtainium. We will revisit our D&O insurance levels in another three years.

We continue to have issues with excessive compliance from our EU entity. I strongly urge the Board to consider creating a new federated governance model to be applied to all OWASP subsidiary entities, and once that is done, move the EU entity to the Netherlands or Ireland to reduce compliance costs whilst building our mission and financial capabilities.

Lastly, AppSec Australia continues to drag on. I made a recommendation to the Board to not proceed after not hearing from the organizers for over a week after a longer gap before that. Vandana and I met with Daniel, who explained his extenuating circumstances. We agreed that the Board shall discuss the matter privately, and Daniel and myself will improve communications, such as ensuring that he lets us know when things are overwhelming and from our side, when things are due.

Attached, please find the preliminary OWASP Combined (converted to USD for all reports) financial pkg for March 2021, which represents financial performance for the 3rd month of the fiscal year 2021. I have included the 2021 approved budget, which I have spread on a monthly basis. I have also altered the Board summary to match the categories that the new FY 21 budget highlights. Finally, I have included a YOY Balance sheet which we will review at the Board call next week.

Income Statement:

• Revenue: On an accrual basis, total revenue, YTD was $250.1K as compared to the budget of $186.8K. The results are better by $63.3K, with conferences, donations, and over budget by $16K and $37K and $28K, respectively. Merchandise and trademark income were a combined <$17.5K> below budget YTD.
• Expenses: Total spending YTD 2021 is $263.5K which is LESS than the YTD Expense budget of $296.6K by $33.1K due to Chapters, Outreach and Project expenses are UNDER budget by $48.1K offsetting EDU, WIA, Events, Fundraising, and G&A, which combined is over $14.9K (individual accounts have minimal overages).
• Net Income/Loss: YTD 2021 Net income, on a combined accrual basis, is Negative $13.4K which is Better than the YTD 2021 APPROVED budget of negative <$109.9K> by $96.5K. Chapter Funds: US bal is $855.64K (up $6.8K) EU Ch bal is $60.6K (down $4.3K). US Proj bal is $219.2K (Up $10.7K). EU Proj bal is $-8.5K

POINTS of NOTE:

Continuing the narrative theme from previous months, as of 3.31.21, our cash position was $1,140.2K, which is up $13.1K from 2.28.21 cash balance of $1,127.1K. Our avg monthly spend for operations is roughly $82K including all payroll, which is still roughly about 13.9 months of reserve, which is very good in the current environment. If we remove AP and the PPP loan ($112.7K of PPP is in the process of being forgiven. However, I will keep it here until it is), which totals $148.2K and is just over 1.8 months of reserve taking, us to an estimated 12 months of operating reserve, again a good number. Now the concern is the $1,126.7K of Ch/Proj balances.

On a good note, deferred revenue is starting to build up again at $122.3K, which is a little over one month of reserve. However, the open AR balance is $131.2K, which I am told is all collectible, so that almost offsets the deferred revenue just mentioned (though I would like to see us collect the $53.7K that is over 60 days old). Through March 2021, we are tracking a bit better than budget. We need to keep working on revenue while keeping costs down while we are still in this no-travel environment.

See presentation from Lisa Jones in this meeting.

Looking for assistance with:

• Event Committee: establishing this committee and getting them going
• AppSec Australia 2021

Corporate Membership

• Sold $177,800 to date, 88.9% of the budgeted ($200,000) amount for FY 2021

Full report

• April Events Summary

• The merchandise store will be announced next week and is in final testing
• P&L's for conferences are up to date. We can only complete early 2021 event P&L's once we receive the Event Brite payment in May / June.

• Project Status

Projects:

• 8 New projects in the last 60 days
• Project Committee is re-working the Project Graduation procedures, Project Policy, and Contribution policies for projects.
• Working with Vandana to see if the developer event can be combined with projects to create a summit/developer style event.

Technology:

• Email for members/leaders cleanup in testing
• Regional promotion updates
• Membership Portal (members.owasp.org) prioritized over other automation; open to testing by staff and board members

Other:

• Conflict of Interest draft policy in review

Background: The Outreach Committee has worked on a revised Charter under the new Charter policy. A representative has been invited to this meeting to discuss the charter with the Board.

Motion: "Resolved, the Board approves the Outreach Charter as found here."

• Sponsor: Grant Ongers
• Second: Vandana Verma