Level 2: Compliance
At this level, an organization has established some practices for managing open source software. The organization has some visibility into open source use and there are limited controls in place to manage open source software and to ensure compliance with licenses.
The Open Source Program Office (OSPO)
At this stage, the organisation might have an Open Source Program Office (OSPO) or something equivalent by a different name. IBM refers to an Open Source Steering Committee (OSSC), for example.
According to the TODO Group's maturity model:
In general, an organization forms an OSPO when it realizes that its people are consuming open source products and code across nearly all engineering and development departments and functions. This usage is typically internal, not part of products or services to customers or users.
Further Reading
The OW2 Open Source Good Governance Initiative refers to this level as the "Trust Goal". It talks about license compliance tools and processes and provides links to many of these tools:
[This level] is about the secure and responsible use of OSS. It covers in particular compliance and dependency management policies. It is about aiming for the state of the art in implementing the right processes.
The TODO Group refers to this level as "Providing OSS Compliance, Inventory, and Developer Education".