Certification of Origin - Security paperwork BS

This is a a question for @koconnor:

Sorry to bother you, but “my company” is requiring a certification of origin on all the software we use (even open source). I can understand if you are hesitant to help, but due diligence on my part… Thanks for your time!