Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-eo

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Executive Order 14028,  Improving the Nation's Cybersecurity

-  Software Supply Chain Security Guidance  Expand or Collapse    -  Software Security in Supply Chains  Expand or Collapse      -  Guidance, Purpose, Scope, and Audience 
    -  EO-Critical Software and Security Measures for EO-Critical Software 
    -  Software Cybersecurity for Producers and Users  Expand or Collapse        -  Attesting to Conformity with Secure Software Development Practices 
    -  Software Verification 
    -  Evolving Standards, Tools, and Recommended Practices  Expand or Collapse        -  Software Bill of Materials (SBOM) 
      -  Enhanced Vendor Risk Assessments 
      -  Open Source Software Controls 
      -  Vulnerability Management 
    -  Additional Existing Industry Standards, Tools, and Recommended Practices 
    -  FAQs 
  -  Software Cybersecurity for Producers and Purchasers 
  -  Critical Software  Expand or Collapse      -  Critical Software Definition  Expand or Collapse        -  Introduction 
      -  Background & Approach 
      -  Definition & Explanatory Material 
      -  FAQs 
    -  Security Measures for Critical Software Use  Expand or Collapse        -  Introduction 
      -  Purpose & Scope 
      -  Security Measures for EO-Critical Software Use 
      -  FAQs 
  -  Software Verification  Expand or Collapse      -  Introduction 
    -  Background & Approach 
    -  Recommended Minimum Standard for Vendor or Developer Verification of Code 
    -  FAQs 
-  Cybersecurity Labeling for Consumers  Expand or Collapse    -  Consumer Cybersecurity Labeling Pilots: The Approach and Contributions 
  -  Workshops on Cybersecurity Labeling of Consumer Products 
  -  IoT Product Criteria 
  -  Consumer Software Criteria 
  -  News & Updates 
  -  Engage 
  -  Resources 
  -  FAQs 
-  Workshops & Call for Papers 
-  News & Updates 
-  Engage 
-  Fact Sheet 
-  Resources 
-  FAQs 
-  Cybersecurity @ NIST 

# Software Security in Supply Chains: EO-Critical Software and Security Measures for EO-Critical Software

## Share

Facebook

Linkedin

Twitter

Email

Following the EO’s directive, NIST’s definition for critical software reflects “the level of privilege or access required to function” and “integration and dependencies with other software.”[1]

NIST has also published guidance outlining security measures to protect the revised set of designated critical software.

## Definition of EO-Critical Software

NIST’s publication on the definition of critical software enhances traditional notions of context-based criticality with function-based definitions. Table F-1 identifies the points at which criticality considerations in SP 800-161, Rev. 1, may be informed but should not be superseded by the new EO-critical software definition.

### **Table F‐1****: Impacts of EO-critical software definition on SP 800-161, Rev. 1, guidance for Federal Agencies**

## Security Measures (SM) for EO-Critical Software Use

NIST published “Security Measures for ‘EO-Critical Software’ Use Under Executive Order (EO) 14028” in July 2021. Software supply chain security measures are essential for internal decision-making and for supplier oversight. Federal agencies must recognize their status as critical players in the software supply chain and should, at a minimum, implement the same security controls internally that they require of their software suppliers. All of the EO Security Measures should be considered for all software, not just for EO-critical Software.

The table below outlines the mappings and coverage of the EO’s security measures across SP 800-161, Rev. 1, controls, control enhancements, and supplemental guidance outlined in the main body of this document. Many of these are included in the C-SCRM controls baseline.

EO Security Measures and their associated NIST SP 800-161, Rev. 1, controls (with the exception of AC-6, CA-7, and SR-8) are considered “flow down.” Enterprises should require prime contractors to implement this control and flow down this requirement to relevant sub-tier contractors where feasible.

Federal agencies that align to SP 800-161, Rev. 1, controls should use the below table to aid in conforming with EO Security Measures and to ensure their effective application across the software supply chain and acquisition life cycle.

### **Table F‐2****: C-SCRM Control and Security Measure Crosswalk**

The measures are intended to secure the use of deployed EO-critical software in federal agencies’ operational environments. Security measures for EO-critical software are not intended to be comprehensive, nor do they eliminate the need for other security measures.

One provision in “Security Measures for ‘EO-Critical Software’ Use Under Executive Order (EO) 14028” falls outside of the scope of SP 800-161, Rev. 1. Security Measure 2.5 outlines a requirement to “back up data, exercise backup restoration, and be prepared to recover data used by EO-critical software and EO-critical software platforms at any time from backups.[3]” Though relevant to sound C-SCRM practices, controls related to Security Measure 2.5 are not included in SP 800-161, Rev. 1, because they are not third-party risk-related. Rather, they focus on managing the software within a system.

Mappings to Security Measure 2.5 and partial security measure mappings outside of the scope of this document are outlined in the table below.

Federal agencies that seek to fully conform with all mapped controls across all EO security measures, regardless of whether they are C-SCRM-specific in nature, may use this table to accelerate conformance or refer directly to “Security Measures for ‘EO-Critical Software’ Use Under Executive Order (EO) 14028.”

### **Table F‐3****: C-SCRM Control and Security Measure Crosswalk**

--------------

[1] National Institute of Standards and Technology. (2021). Definition of Critical Software Under Executive Order (EO) 14028. 

[2] While the base control is not addressed within SP 800-161, Rev. 1, the topic at large is addressed through supplemental guidance provided for control enhancements to the base control within SP 800-161, Rev.1.

[3] National Institute of Standards and Technology. (2021). Security Measures for “EO-Critical Software” Use Under Executive Order (EO) 14028. 

----

**Content:**
                  -  Introduction 
                  -  Guidance, Purpose, Scope, and Audience 
                  -  EO-Critical Software and Security Measures for EO-Critical Software 
                  -  Software Cybersecurity for Producers and Users                      -  Attesting to Conformity with Secure Software Development Practices
                  -  Software Verification 
                  -  Evolving Standards, Tools, and Recommended Practices                      -  Software Bill of Materials (SBOM) 
                    -  Enhanced Vendor Risk Assessments 
                    -  Open Source Software Controls 
                    -  Vulnerability Management
                  -  Additional Existing Industry Standards, Tools, and Recommended Practices 
                  -  Frequently Asked Questions (FAQs) 

Information technologyCybersecurity

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov