Workshop on Enhancing Software Supply Chain Security 

June 2-3, 2021 

Workshop Purpose: 

• Inform NIST’s immediate and longer-term decisions around software supply chain

security initiatives as required in Executive Order 14028.

June 2, 2021: Day 1 Agenda (all times EDT) 

1:00 – 1:10PM Welcome and Logistics – Matt Scholl, NIST 

1:10 – 1:20PM Opening Remarks – Jeff Greene, Acting Senior Director for Cybersecurity, 

White House National Security Council 

1:20 – 1:50PM Government Updates -

Chris DeRusha, Federal Chief Information Security Officer, OMB 

Eric Goldstein, Executive Assistant Director for Cybersecurity, CISA 

Allan Friedman, Director of Cybersecurity Initiatives, NTIA 

1:50 – 2:10PM NIST Tasks and Implementation Approach – Kevin Stine, NIST 

2:10 – 2:15PM Break – Panel Transition 

2:15 – 3:15PM Panel 1 – Criteria for Designating Critical Software 

Abstract: This panel will discuss candidate criteria for designating 

software as critical. 

Moderator: Barbara Guttman, NIST 

Panelists: 

Henry Young, BSA | The Software Alliance 

David A. Wheeler, Linux Foundation 

Andrew Howell, Enterprise Cloud Coalition 

Amanda Craig, Microsoft 

3:15 – 3:20PM Break – Panel Transition 

3:20 – 4:50PM Panel 2 – Secure Software Development Standards, Practices, and 

Conformance. 
 

 

 

 

 

 

 

 

 

 

 

 

 

Abstract: This panel will discuss current and emerging methodologies for 

secure software development throughout the development lifecycle, 

including standards, guidelines, and practices, and ways to demonstrate 

conformance to those resources. The guidelines for software integrity 

chains and provenance will be covered in this session. 

Moderator: Karen Scarfone, Scarfone Cybersecurity 

Panelists: 

Steve Lipner, SAFECode 

Colm MacCarthaigh, Amazon Web Services 

Shoshana Wodzisz, Rockwell Automation 

Daniel Riedel, Copado 

Shlomi Ben-Hur, Micro Focus 

4:50 – 5:00PM Summary of Day 1 – Kevin Stine, NIST 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Workshop on Enhancing Software Supply Chain Security 

June 2-3, 2021 

June 3, 2021: Day 2 Agenda (all times EDT) 

1:00 – 1:15PM 

1:15 – 2:45PM 

2:45 – 3:00PM 

3:00 – 4:00PM 

4:00 – 4:15PM 

Welcome and Logistics – Kevin Stine, NIST 

Panel 3– Tools and Techniques for Testing Software 

Abstract: This panel will discuss tools and techniques for testing software 

source code including defining types of manual or automated testing, 

their recommended uses, best practices, and security benefits. 

Moderator: Paul E. Black, NIST 

Panelists: 

Randall Brooks, Raytheon Technologies 

Alexa Lee, Information Technology Industry Council 

Jeff Williams, Contrast Security 

John Keane 

Johnathan Hunt, GitLab 

Romain Berrendonner, AdaCore 

Break – Panel Transition 

Panel 4– Security Measures for Critical Software 

Abstract: This panel will discuss guidelines outlining security measures to 

be applied to Federal government use of critical software, including but 

not limited to, least privilege, network segmentation, and proper 

configuration. 

Moderator: Jon Boyens, NIST 

Panelists: 

Jon McCune, Google 

Gabriel Davis, CISA 

Alexander “RoRo” Romero, Intel 

Kent Landfield, McAfee 

Summary of Day 2 and Next Steps – NIST