U.S. flag
        An official website of the United States government
          Here’s how you know
        Here’s how you know**Official websites use .gov**
              
              A **.gov** website belongs to an official government organization in the United States.
        **Secure .gov websites use HTTPS**
              
              A **lock** (  A locked padlock
) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/workshop-and-call-position-papers
  Search NIST
    Search
              Menu

      


Close
    Topics
        All Topics
                                                        Advanced communications
                                                        Artificial intelligence
                                                        Bioscience
                                                        Buildings and construction
                                                        Chemistry
                                                        Climate
                                                        Cybersecurity
                                                        Electronics
                                                        EnergyEnvironment
                                                        Fire
                                                        Forensic science
                                                        Health
                                                        Information technology
                                                        Infrastructure
                                                        Manufacturing
                                                        Materials
                                                        Mathematics and statisticsMetrology
                                                        Nanotechnology
                                                        Neutron research
                                                        Performance excellence
                                                        Physics
                                                        Public safety
                                                        Resilience
                                                        Standards
                                                        Transportation
            Publications
            Labs & Major Programs
        Laboratories
                                Communications Technology Laboratory
                                  Engineering Laboratory
                                  Information Technology Laboratory
                                  Material Measurement Laboratory
                                  Physical Measurement LaboratoryUser Facilities
                                NIST Center for Neutron Research
                                  CNST NanoFab
                                                        Research Test Beds
                                                        Research Projects
                                                        Tools & InstrumentsMajor Programs
                                Baldrige Performance Excellence Program
                                  CHIPS for America Initiative
                                  Manufacturing Extension Partnership (MEP)
                                  Office of Advanced Manufacturing
                                  Special Programs Office
                                  Technology Partnerships Office
            Services & Resources
        Standards and Measurements
                                Calibration Services
                                  Laboratory Accreditation (NVLAP)
                                  Quality System
                                  Standard Reference Materials (SRMs)
                                  Standards.gov
                                  Time Services
                                  Office of Weights and MeasuresSoftware
                                                        Data
                                Chemistry WebBook
                                  National Vulnerability Database
                                  Physical Reference Data
                                  Standard Reference Data (SRD)
                                                        Storefront
                                                        License & PatentsComputer Security Resource Center (CSRC)
                                                        NIST Research Library
            News & Events
        News
                                                        Events
                                                        Blogs
                                                        Feature Stories
                                                        AwardsVideo Gallery
                                                        Image Gallery
                                                        Media Contacts
            About NIST
        About Us
                                Leadership
                                  Organization Structure
                                  Budget & Planning
                                                        Contact Us
                                                        Visit
                                                        Careers
                                Student programsWork with NIST
                                                        History
                                NIST Digital Archives
                                  NIST Museum
                                  NIST and the Nobel
                                                        Educational Resources
 
 Information Technology Laboratory
      Executive Order 14028,  Improving the Nation's Cybersecurity
    
      
  Software Supply Chain Security Guidance
                            Expand or Collapse
          Software Security in Supply Chains
                                              Expand or Collapse
                Guidance, Purpose, Scope, and Audience
                                  EO-Critical Software and Security Measures for EO-Critical Software
                                  Software Cybersecurity for Producers and Users
                                                                Expand or Collapse
                      Attesting to Conformity with Secure Software Development Practices
                                  Software Verification
                                  Evolving Standards, Tools, and Recommended Practices
                                                                Expand or Collapse
                      Software Bill of Materials (SBOM)
                                              Enhanced Vendor Risk Assessments
                                              Open Source Software Controls
                                              Vulnerability Management
                                  Additional Existing Industry Standards, Tools, and Recommended Practices
                                  FAQs
                      Software Cybersecurity for Producers and Purchasers
                      Critical Software
                                              Expand or Collapse
                Critical Software Definition
                                                                Expand or Collapse
                      Introduction
                                              Background & Approach
                                              Definition & Explanatory Material
                                              FAQs
                                  Security Measures for Critical Software Use
                                                                Expand or Collapse
                      Introduction
                                              Purpose & Scope
                                              Security Measures for EO-Critical Software Use
                                              FAQs
                      Software Verification
                                              Expand or Collapse
                Introduction
                                  Background & Approach
                                  Recommended Minimum Standard for Vendor or Developer Verification of Code
                                  FAQs
          Cybersecurity Labeling for Consumers
                            Expand or Collapse
          Consumer Cybersecurity Labeling Pilots: The Approach and Contributions
                      Workshops on Cybersecurity Labeling of Consumer Products
                      IoT Product Criteria
                      Consumer Software Criteria
                      News & Updates
                      Engage
                      Resources
                      FAQs
          Workshops & Call for Papers
          News & Updates
          Engage
          Fact Sheet
          Resources
          FAQs
          Cybersecurity @ NISTWorkshop and Call for Position Papers

Share
  Facebook
                      Linkedin
                      Twitter
                      Email

Workshop and Call for Position Papers on Standards and Guidelines to Enhance Software Supply Chain Security

Final Agenda

NOTE: This workshop has taken place. More than 1,400 participants took part in the June 2-3 virtual event, with many actively involved by posing questions or joining the online chat. More than 150 position papers were submitted; they are available here. A high-level summary of the workshop can be found here.

The National Institute of Standards and Technology (NIST) will host a **virtual workshop on****June 2 and 3, 2021** to enhance the security of the software supply chain and to fulfill the President’s Executive Order onImproving the Cybersecurity of the Federal Government (14028), issued on May 12, 2021.

Among other things, Section 4 of that Executive Order (EO) directs the Secretary of Commerce, through NIST, to consult with federal agencies, the private sector, academia, and other stakeholders in identifying standards, tools, best practices, and other guidelines to enhance software supply chain security. Those standards and guidelines will be used by other agencies to govern the federal government’s procurement of software.**The EO includes additional assignments to NIST which will be addressed in other forums, although discussions at this workshop will inform those actions by NIST. This workshop focuses on assignments in Section 4 of the EO.

The goals of the workshop are to:

share NIST’s plans to develop software-related standards and guidelines called for by the Executive order, andreceive and discuss information and ideas about the approach and content that NIST should consider in developing those standards and guidelines.The agenda for the two-day workshop, which will take place from 1-5 pm EDT on each day, will be based on submissions to NIST by the private, public, and non-profit sectors in the form of two-page position papers. These papers from organizations and individuals will be reviewed for their diversity of ideas in order to ensure that NIST considers a wide range of approaches for achieving the goal of the EO and that the standards and guidelines identified are practical and effective. NIST seeks to build on existing approaches and capabilities to avoid duplication and to speed implementation of needed security steps while also encouraging creative thinking and new approaches. *All suggestions in position papers****must be* *consistent with and* *within the scope****of the assignments****specified by the EO*. Topics and speakers selected for the workshop will be based largely on these position papers. NIST expects speakers to participate in panel discussions.

Timelines in the EO are very tight, as are the deadlines for contributing position papers for this workshop. **All submissions must be received by NIST no later than May 26, 2021.**

NIST seeks position statements in five areas.

*Criteria for designating "critical software.”*  Functional criteria should include, but not be limited to, level of privilege or access required to function, integration, dependencies, direct access to networking and computing resources, performance of a function critical to trust, and potential for harm if compromised. See EO Section 4(g).*Initial list of secure software development lifecycle standards, best practices, and other guidelines acceptable for the development of software for purchase by the****federal****government.*  This list of standards shall include criteria and required information for attestation of conformity by developers and suppliers.  See EO Section 4(e)(i, ii, ix, and x).*Guidelines outlining security measures that shall be applied to****the****federal****government’s****use of critical software,* including but not limited to, least privilege, network segmentation, and proper configuration.  See E.O. Section 4(I).*Initial minimum requirements for testing software****source****code* including defining types of manual or automated testing (such as code review tools, static and dynamic analysis, software composition tools, and penetration testing), their recommended uses, best practices, and setting realistic expectations for security benefits. See EOSections 4(e)(iv and v) and 4(r).*Guidelines for software****integrity****chains and provenance.*  See EO Sections 4(e)(ii, vi, and viii).Position papers should specify which of the five areas is being addressed and be a maximum of two pages in length. Supplemental material may be provided but selections of position papers to be presented at the workshop will be based on the brief papers.  Submissions will be accepted from those who do not wish to be considered as speakers. For those who wish to be considered as speakers at the workshop, submissions should include the individual’s names, titles, and contact information. NIST will make available online all statements which are within the scope of this request but reserves the right to withhold publication of material deemed inappropriate, including strictly promotional information.

**Position papers should be submitted********to**: swsupplychain-eo [at] nist.gov(swsupplychain-eo[at]nist[dot]gov) no later than May 26, 2021. Receipt of submissions will be acknowledged via email.

**Registration for the********no-fee virtual********workshop.** Workshop attendees will be able to submit questions online during the sessions. **A recording of the workshop is expected to be available after the event.** **Advance registration will be required.**

*Questions about the position papers* should be directed to: swsupplychain-eo [at] nist.gov(swsupplychain-eo[at]nist[dot]gov).
  Information technology and Cybersecurity

    
    Created May 13, 2021, Updated June 11, 2021
 HEADQUARTERS
            100 Bureau Drive
              Gaithersburg, MD 20899301-975-2000
            Webmaster | Contact Us | Our Other Offices
        Twitter
            
Facebook
            
LinkedIn
            
Instagram
            
YouTube
            
Giphy
            
RSS Feed
            
Mailing List
                              How are we doing? Feedback

  
  Site Privacy
                      Accessibility
                      Privacy Program
                      Copyrights
                      Vulnerability Disclosure
                      No Fear Act Policy
                      FOIA
                      Environmental Policy
                      Scientific Integrity
                      Information Quality Standards
                      Commerce.gov
                      Science.gov
                      USA.gov
                      Vote.gov