December 2021 Minutes

Background: Currently, the OWASP Foundation has a $10k credit limit with two card holders personally guaranteed by the OWASP Executive Director. As the world opens up, and travel resumes, and as some of the Foundation's monthly expenses rise, we regularly need to pay down the credit cards before the due date. Additionally, the activity is negatively affecting Andrew's credit score. A better solution is for the OWASP Foundation to apply in its own right to a financial institution for new cards.

• eVote

Motion: "Resolved, the OWASP Foundation Executive Director and CFO are authorized to establish Foundation secured corporate credit cards for staff expenses and travel, with a total limit of $30k USD, replacing the personal guarantee Amex credit cards in use by the ED and one staff member today."

• Sponsor: Grant Ongers
• Second: Sherif Mansour

Sherif Mansour:     YES
Vandana Verma:      YES
Grant Ongers:       YES
Bil Corry:          YES
Joubin Jabbari:     YES
Martin Knobloch:    YES
Owen Pendlebury:    No vote

Motion passes (6/0)

• Board Oversight Reporting
• November Financial Package
• Events and Corporate Support

• Executive Director Report

As we close out 2021, it's important to remember all the successes we've had. We're ending the year on the highest ever member count, our 20th Anniversary was a tremendous success, and we have established several grants, which are actively being used to deliver project value by our project leaders and community. The OWASP Top 10 2021 was released and was well received by the public and many in our industry. We are leaving 2021 with a better balance sheet than at the start through all the hard work of our staff, Virtual, our community and the Board. We have our first new mission in 20 years, one that actually reflects what we do.

All of us - community, Board and staff alike should be proud of our collective successes, because we got it done collaboratively as a team.

We have completed the majority of policy reform, and compared to the community tumult of 2020, by returning to our community's root and consent, 2021 has seen a lot of community return and actively participating in projects, meetings, and events. The last remaining policies to be reformed are:

• Regional chapter amendment for chapter policy (see above)
• Privacy (an update for a GDPR policy will be required, currently in progress)
• Travel policy (to be written)

In October, the LASCON team held one of the only in person events at OWASP worldwide, which although a success, demonstrated the limits of in person events being held during a pandemic. Our next in person AppSec Days event is SnowFroc in 2022. As there were significant doubts on the profitability of AppSec Dublin, the Board wisely chose to cancel the in person event, and change to a virtual event. Although not potentially as profitable as an in person event in a good year, there's a good chance it will make more profit than many recent AppSec EU events. We will continue to monitor the profitability of our events.

Thank you to Owen Pendlebury, our 2020 Chair and Sherif Mansour, our current chair for their extraordianry service over the last four years. Personally, I am sure I will find their valuable counsel and direction will be missed by myself, and probably many on the Board and within the OWASP Community as well. I encourage them both to become involved in their passions for events and projects after their duties on the Board have finished.

Lastly, I want to say a HUGE thank you to all the OWASP Foundation staff and our partners at Virtual Inc (especially Tom Pappas) for one of the busiest and most successful years in OWASP history. Our team not only overachieved everywhere, we completed the majority of a packed Operating Plan including all of the necessary finance reform that had been holding our community back. Without our team's immense efforts, OWASP would not be here today.

I look forward to the OWASP Foundation delivering improved customer experiences, more member benefits, and greater impact and community in 2022, along with a new association management platform. Lastly, and nothing is taken for granted, hopefully we can run an in-person Global AppSec San Francisco in November next year, and see many folks there safely in person.

• November Financial Package

Attached please find the financial package for the combined OWASP which represents financial performance for the eleven months ended November 30th, 2021. Statement of Activities – Accrual Basis

The following is a summary of the YTD Statement of Activities:

Revenue: On an accrual basis, total revenue through November 30th, 2021, is \1,010,548 as compared to an approved budget of $1,315,849. Revenues are under the approved budget by $305,301.

The reasons for this include:

• OWASP budgeted for an Australia day at $350,000 that did not happen.
• LASCON was budgeted at $110,00 though actual revenue was $86,300
• Individual Membership is $300,204 vs a Budget of $137,500 so $162,704 above Budget, vs Corp membership due to recognizing what we have earned (based on paid Corp membership) the budget is $183,33 vs actual of $122,750 or $60,583 below budget.
• Donations budgeted at $33,000 vs actual of $65,741 or $32,741 above Budget

Expenses: On an accrual basis, total expenses through November, 2021, are $988,802 as compared to an approved YTD budget of $1,378,680. The results are OWASP is $389,878 under the approved budget

The reasons for this include:

• Project spending is under budget by $48,475 due to less actual Project spending and Project Platform fees as compared to the 2021 Budget.
• Event spending is $289,595 BELOW budget due to no Australia day ($80K), LASCON $66K below budget along with being significantly below budget for all other 2021 events to date.
• Outreach is $3,930 below budget due to underspending in Marketing offset by Meetup fees.
• Chapter spending is $67,757 under budget due to travel restrictions and on line events
• G&A is $48,805 above budget due to Legal fees and Insperity payroll fees offset by underspending in Fundraising, EDU and WIA by $28,927 underspending

Net Income/Loss: Net Profit (Loss) as of November 30th, 2021, is $21,746. The approved budgeted net profit (loss) was Negative -$62,831. The actual net profit is better than budget by $84,577 due to underspending more than offsets the Revenue deficit 11 months through the year.

Months of Operational Reserve: With a cash balance of $1,475,281 which is $206,535 more than 11.30.20 less $77,809 of AP and $168,597 of Project reserves leaves about 13.7 months of Operational reserves and when the $361,333 of open AR is collected it will add about 4 months more of operational reserve. The Foundation while very well capitalized and well above the Non Profit industry Avg of 6 months of Operational reserve must still keep a close eye on spending and maximizing revenue opportunities as we close 2021 and move into 2022

265 Active Chapters 53 New Chapters added to date - 16 are Student chapters 13 Chapters granted reactivation exception in May deactivated again:

Fix the inactive chapter merry-go-round

Leaders are not grasping that a meeting needs to occur in 90 days of reactivation. Requirements should be clear and simple to understand and automate.

• An inactive OWASP chapter is a chapter that has not met the minimum activity requirements defined in this policy.
• An inactive chapter must either be reactivated or dissolved.
• The OWASP Foundation will revoke the inactive chapter leadership and refer the inactive chapter to the Chapter Committee to help find fresh leadership or to run elections to elect new leadership.
• Use this form to reactivate a chapter. Where an inactive chapter does not hold a meeting within 90 days of being reactivated, or new leadership could not be appointed within 90 days of failing to meet activity targets, the Chapter Committee will discuss the inactive chapter and vote on it. If agreed, the chapter will be dissolved by the OWASP Foundation.

Currently, we have seen several chapters being given multiple chances to become active after the reactivation project concluded. In the following months, these leaders chose not to hold any meetings or activities. However, as soon as they were made inactive, they immediately contacted the Chapter Committee and were granted active status again, with no activity plan or new leadership requirements. Some are now due for their second or third deactivation this year as they again have failed to meet. Our current policy has no methods to stop inactive leaders maintaining inactive chapters indefinitely if they follow the current policy. For example, OWASP Cusco leadership submitted a ticket but did not have the agreement or meet with the Chapter Committee.

We either need to have no policy around inactive chapters as it's completely ineffective now (which would be bad), or alternatively, it needs to be fixed so that inactive chapters are given a realistic chance of new leadership who will actually hold meetings. Being a leader is not a right, but a privilege, and it requires activity to maintain.

We need an re-activation plan amended into the policy to ensure chapters become active for the benefit of OWASP's mission and our members, otherwise we will continue to waste valuable OWASP committee, volunteer, and staff time, and effectively allow OWASP funds to go down the drain month after month. Worst of all, local chapter members are denied meetings and our community.

One way to amend the chapter policy's reactivation clauses is for inactive leaders to meet with the Chapter committee to discuss and document an agreed-upon plan to reactivate. The plan's terms must include dates to complete, and should include that this is a final exception. A representative from the chapter leadership and Committee needs to be dated and signed to submit the ticket to reactivate to keep on file. If the terms of the activation plan are not successful, the chapter is made inactive, and the inactive leaders will not be permitted to hold another leadership position for a period of 12 months. A new leadership team not consisting of any of the ineligible leaders could step up during this time, to permit local members a chance to hold meetings and take over the chapter permanently.

With some luck, a policy change to provide a circuit breaker will stop the merry-go-round of reactivation for the benefit of our members.

Leaders as members

Historically since 2008, you don't need to be an OWASP member to be an OWASP leader, which is practically unique in non-profit membership organizations such as OWASP.

Slowly over time, we have been increasing our membership to support OWASP's mission and activities. It's almost certainly time to re-evaluate the role of membership requirements for leaders. As this can be a controversial topic in OWASP by a very small minority of leaders (only 8% have taken up complimentary membership), it's time to re-evaluate if complimentary membership and indeed optional membership for leaders is desirable from a policy perspective for a membership organization.

In 2020, the Board created a mechanism that allowed for complimentary membership for active leaders in 2020. Recently that changed it to remove the un-automatable aspects of the policy. Take up of complimentary membership has been very low by leaders, and it costs the Foundation funds to maintain and provide benefits to those 1.2% of members who do not pay any fees.

We recommend the Board consult with the 5400+ strong OWASP Member Community to detemine if it's time to require OWASP leaders to be OWASP members, such as in pretty much all other membership organizations, and if so, if complimentary memberships should be abolished as it both demonstrates a lack of committment to the organization as well as devaluing the memberships of the other 5380+ members.

                17-Nov  17-Dec  Increase 
One Yr/Student  3444    3522    78
Two Yr          1084    1095    11
Lifetime        748     761     13
Complimentary   83      85      2

Total           5359    5463    104

Membership Benefit Partnerships in the pipeline:

• AppSec Phoenix - end of January 2022
• Security Journey - Security Dojo Contract negotiations

• December Update

• In the process of finalizing the onboarding of elected Board Members for 2022.
• Annual Conflict of Interest Questionnaire will be sent to all Board Members in the first week of January 2022.
• Tom finalizing new credit card for Operations for 2022.

Currently updating project/chapter/committee reporting items so project #s are not available

• 237+ Projects
• 6 New projects in the last 60 days

Technology

• Email for members/leaders cleanup testing completed successfully but will not resume until after the first of the year
• As mentioned, updating group reporting functionality
• Moving to Meetup GraphQL