Who should be involved: legal, security, engineering and procurement?

Open source explained in plain language.

All, depending on the choice. Legal looks at rights and obligations. Security looks at vulnerabilities and management. Engineering looks at quality and application. Procurement looks at contracts and suppliers.

Open source often affects multiple responsibilities at the same time.