Kemp Little have written guidance on governance associated with use of open source software.

They've kindly agreed to let us put it on our website