CC-BY licenses (Creative Commons Attribution) are common for icons, illustrations, photos, data, and documentation snippets bundled in software. The license allows commercial use. In return it asks for a credit to the creator, given in any reasonable way for the medium.
Where the credit can go
Put the credit where people come across the work: a credits screen, an about box, the notices or documentation that come with your product, or the screen where the work appears. A link from there to a page that holds the credit is also enough. While the work reaches nobody outside your company, no credit is owed, and you tick the step once you are sure of that. Listing the package on your SourceTrust attestation page helps procurement as well.
What good attribution includes
- Creator name (and link if the license or creator requests it).
- License name (e.g. CC BY 4.0) and any title of the work if supplied.
- Indication if you modified the work (when modifications are allowed).