CAN/CSA-ISO/IEC 19770-2:16

Foreword
Introduction
1 Scope
2 Normative references
3 Terms, definitions, and abbreviated terms
4 Conformance
5 Interoperability guidance
6 Implementation of software identification tagging processes
7 Platform requirements and guidance
8 Elements
Annex A (informative) - XSD changes between revisions
Annex B (normative) - XML schema definition (XSD)
Annex C (informative) - UML structure of SWID tag schema
Annex D (informative) - Sample tags
Bibliography

Sets up specifications for tagging software to optimize its identification and management.

Preface Standards development within the Information Technology sector is harmonized with international standards development. Through the CSA Technical Committee on Information Technology (TCIT), Canadians serve as the SCC Mirror Committee (SMC) on ISO/IEC Joint Technical Committee 1 on Information Technology (ISO/IEC JTC1) for the Standards Council of Canada (SCC), the ISO member body for Canada and sponsor of the Canadian National Committee of the IEC. Also, as a member of the International Telecommunication Union (ITU), Canada participates in the International Telegraph and Telephone Consultative Committee (ITU-T). For brevity, this Standard will be referred to as \"CAN/CSA-ISO/IEC 19770-2\" throughout. At the time of publication, ISO/IEC 19770-2:2015 is available from ISO and IEC in English only. CSA Group will publish the French version when it becomes available from ISO and IEC. Scope This part of ISO/IEC 19770 establishes specifications for tagging software to optimize its identification and management. This part of ISO/IEC 19770 applies to the following. a) Tag producers: these organizations and/or tools create software identification (SWID) tags for use by others in the market. A tag producer may be part of the software creator organization, the software licensor organization, or be a third-party organization. These organizations and/or tools can broadly be broken down into the following categories. 1) Platform providers: entities responsible for the computer or hardware device and/or associated operating system, virtual environment, or application platform, on which software may be installed or run. Platform providers which support this part of ISO/IEC 19770 may additionally provide tag management capabilities at the level of the platform or operating system. 2) Software providers: entities that create, license, or distribute software. For example, software creators, independent software developers, consultants, and repackagers of previously manufactured software. Software creators may also be in-house software developers. 3) Tag tool providers: entities that provide tools to create software identification tags. For example, tools within development environments that generate software identification tags, or installation tools that may create tags on behalf of the installation process, and/or desktop management tools that may create tags for installed software that did not originally have a software identification tag. b) Tag consumers: these tools and/or organizations utilize information from SWID tags and are typically broken down into the following two major categories: 1) software consumers: entities that purchase, install, and/or otherwise consume software; 2) IT discovery and processing tool providers: entities that provide tools to collect, store, and process software identification tags. These tools may be targeted at a variety of different market segments, including software security, compliance, and logistics. This part of ISO/IEC 19770 does not prescribe Information Technology Asset Management (ITAM) or other IT-related processes required for reconciliation of software entitlements with software identification tags or other IT requirements. This part of ISO/IEC 19770 does not specify product activation or launch controls. This part of ISO/IEC 19770 is not intended to conflict either with any organization%u2019s policies, procedures or standards or with any national or international laws and regulations.