Re-use existing components—to lower development costs, accelerate time to market, improve quality and reduce business risk, use existing internal and external components wherever appropriate. Explicitly consider functionality, performance, reliability, maturity, risk, sensitivity and license obligations.

Track and control changes to internal components—to establish and maintain the provenance of all internal components, to identify and protect critical IP and to avoid inadvertent violations of licenses, trademarks, patents, copyrights and trade secrets. Track internal component creation and modification and control the modification of those that are sensitive.

Control re-use of sensitive or external components—to avoid last-minute surprises, guesswork, compromises and risk-taking, and to prevent the loss of intellectual property and facilitate timely and effective remediation. Review and approve the use of any external or sensitive internal components or fragments in a project.

Verify every build and release—to assure prompt discovery of materials inadvertently included in a project and unapproved or precluded modifications to components. Identify and remediate all unapproved components or fragments and changes made to any of those components. Record the metadata for all external components in the associated bill of materials.

Review compliance at project phase transitions—to prevent loss of intellectual property and to assure prompt discovery of new components inadvertently included in the project. At major development milestones, verify that no unapproved components are used in the project or were changed and then used. Review the license obligations of all external components used in the project and ensure compliance with them.

Control component contribution and disposition—to avoid license violations and the attendant disruptions and to constrain the propagation of risky software. Before contributing any component or fragment to an open-source project or transferring ownership to another party, assess the sensitivity of that material. Verify your rights to make that contribution or transfer.

Assess software components before acquisition—to prevent negative post-acquisition surprises. Before buying a software component, identify all internal and external components used in that asset. Identify all external components used in any active project and assess their license obligations with respect to compliance, business objectives and legal policies. Assess the impact of any required rework or change on cost, revenue, quality and so forth.