September 2025 Minutes

Background Gesmer partners will be joining to discuss / answer questions on the formation of a commercial entity for OWASP

Aaron Kriss and Russ Schossbach joined the meeting to provide Legal guidance on forming a for-profit subsidiary (e.g., “OWASP Solutions”) owned by OWASP Foundation

Key Points:

• Common structure: 501(c)(3) owning a for-profit subsidiary for non-mission-aligned activities
• Purpose: Separate commercial ventures (training, consulting, certifications) that may not fit OWASP’s tax-exempt status
• IRS requires operational independence between nonprofit and for-profit entities
• Overlapping leadership is permissible but must avoid control conflicts
• Delaware incorporation recommended

Discussion Highlights

• Ownership: Typically wholly-owned subsidiary (100%)
• Outside investment: Possible but uncommon; must consider investor expectations and ROI
• Profit distribution: Board of subsidiary decides dividends; cannot be mandated by the non-profit
• Donations from subsidiary to nonprofit allowed if independence is maintained
• Licensing OWASP trademarks or content to the for-profit must align with OWASP’s mission and IRS compliance
• Certification programs, training, and consulting may remain under nonprofit if directly mission-aligned
• Lobbying by the for-profit possible but must remain independent
• Merchandise sales taxable; manageable under nonprofit
• Risk transfer (e.g., certification liability) could justify use of a subsidiary

• OWASP Foundation Board Summary

Staffing:

• Marketing role final candidate selected; awaiting offer confirmation
• New hire based outside the U.S.

Website Migration

• Nearing completion; final QA and staging checks in progress
• Migration aims for a modern marketing-focused site
• Minor outstanding items: committees page and www-community migration

Audit & Budget

• Audit on track; FY26 budget work underway with Harold

Working Groups

• Automation for creation and tracking being implemented via Google Workspace and GitHub

Belgian Entity (OWASP EU):

• Awaiting Belgian government approval for new entity
• Old entity winding down; awaiting coordination from legacy directors

Membership:

• September membership drive performing well; above budgeted targets

H-1B Visa Update:

• Recent USCIS changes ($100K filing proposal) highlight benefit of OWASP’s remote-first employment model

Board Elections:

• Candidate pages hosted on GitHub; some technical issues addressed by Dawn and Andrew
• Ricardo confirmed all candidate pages are now accessible and merged

Global AppSec DC:

• Sponsorships sold out
• Registration pacing identical to prior year (~240 six weeks out)
• Active LinkedIn campaigns targeting regional attendees

AppSec Days:

• Singapore: Good attendance, sponsorship exceeded targets
• Israel: Small loss; next year’s event planned with improved profitability measures

Future Planning:

• Full 2026 events calendar to be shared with exhibitors at DC for early sponsor budgeting

Board thanked Lauren and the events team for their continued strong performance

Background

The Community Review Policy process gives 21 days for public comment and a subsequent 30 days for the Policy Review Team to consider the comments and make a recommendation to the Board. This can lead to a long delay in approving policies. This amendment would parallelize the public comment period and the Policy Review Team review period, reducing the overall time to approve policies.

Motion: "Resolved, that the Community Review Policy be amended to conduct the public policy review period and the Policy Review Team review period concurrently." - DEFERRED

Sponsor: Ricardo Griffith Second: Avi Douglen

Motion tabled, discussion took place instead

Discussion:

• Ricardo proposed streamlining to accelerate policy publication
• Sam suggested data analysis of past policy reviews before making changes
• Andrew recommended ensuring adequate pre-reading and public communication
• Board agreed to defer decision pending data

Background Sam Stepanyan will discuss the chapter leader induction/orientation course and training, with a view to starting a Working Group to create the course.

• Chapter Leader Orientation Course

Objective:

Introduce a mandatory orientation training for new (and eventually existing) Chapter Leaders to ensure compliance and consistency.

Key Features

• Video-based learning modules with a short quiz.
• Topics: OWASP mission, chapter operations, event policies, sponsorship, expenses, and use of shared tools (Zoom, Slack, etc.).
• Passing the quiz is a prerequisite for signing the Chapter Leader Agreement.

Board Discussion:

• Harold: Supported; noted it will require policy amendment to enforce.
• Steve: Supported; asked about tracking effectiveness and tool requirements.
• Diego: Suggested extending to all existing chapter leaders.
• Ashwini: Supported; emphasized keeping training concise and recurring annually.
• Andrew: Recommended pilot phase, then integrate into annual leader confirmation process.