POST: BSI recommends using ScanCode.

From https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2.pdf

Principles of licence identification:
- Licences MUST be identified with their SPDX identifier. The indication is made with the so-called identifiers for licences and expressions
- Indication of non-standardised licence identifiers: If licence identifiers cannot be found in the list from SPDX, the licence database Scancode LicenseDB AboutCode MUST be consulted next. Identifiers from this database use the prefix LicenseRef- scancode-[...] in their SPDX identifier to map the origin of the specified identifier.
- Completely unknown licences: If a licence discovery is not available in any of the established identifier lists, the prefix LicenseRef--[...] MUST be used according to “Annex D: SPDX License Expressions” to assign a unique (per LicenseRef namespace) licence identifier.