> For example, "is the OSS project active and/or stable," "when was the last time this OSS project was updated," and "who is contributing to this OSS." Risk mit

> For example, "is the OSS project active and/or stable," "when was the last time this OSS project was updated," and "who is contributing to this OSS." Risk mitigations might include consideration of commercial or in-house support for the OSS component, or availability of feasible alternatives (MOSA) if the component should need replacement in the future Does MOSA includes donations to the mainteners?