Secure Software Development Attestation: A(nother) Government Requirement – JD Supra

On September 14, 2022, the Office of Administration and Price range (“OMB”) issued a memorandum on Enhancing The safety of the Computer software Current Chain by way of Safe Computer software Enchancment Practices (“OMB Memo”) To assist enconstructive software safety. Whereas the OMB Memo provides course to enterprisees, any agency that produces software (outlined as agencyware, working methods, softwares and software providers, Similar to cloud-based mostly Computer software as a Service, or merchandise that embrace software) and expects to license to authorities finish clients should:

• Develop the software in accordance with the Nationwide Institute of Requirements and Know-how (“NIST”) hazard-based mostly secure software development regulars,
• Current a self-attestation, and
• Produce, if requested, docation Similar to a software invoice of supplies or participation in a vulnerability discloconstructive program.

These requirements apply to agency (and contractor) use of software developed, As properly as to Using present software That is modified by primary mannequin modifications, after September 14, 2022.

Background

Final yr, President Biden required federal enterprisees To reintypeationrce agency cybersafety capabilities and shield the nation’s essential software supply chain. See Government Order 14028 (“Cyber EO”). The Cyber EO tasked NIST with creating steerage on supply chain safety which NIST accomplished in February 2022. NIST developed and revealed the NIST Guidance consisting of: (1) the Safe Computer software Enchancment Framework (“SSDF”) Version 1.1 detailing secure software development biggest practices, and (2) Current Chain Security Guidance for federal enterprisees on The biggest Method To accumulate software, collectively with open-supply software and agency-developed software.

Final week’s OMB Memo requires federal enterprisees to Adjust to the NIST Guidance when using third-celebration “software” on the agency’s intypeation methods or completely differentwise affecting the agency’s intypeation.

What Must Corporations …….