U.S. flag
        An official website of the United States government
          Here’s how you know
        Here’s how you know**Official websites use .gov**
              
              A **.gov** website belongs to an official government organization in the United States.
        **Secure .gov websites use HTTPS**
              
              A **lock** (  A locked padlock
) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/critical-software-definition-faqs
  Search NIST
    Search
              Menu

      


Close
    Topics
        All Topics
                                                        Advanced communications
                                                        Artificial intelligence
                                                        Bioscience
                                                        Buildings and construction
                                                        Chemistry
                                                        Climate
                                                        Cybersecurity
                                                        Electronics
                                                        EnergyEnvironment
                                                        Fire
                                                        Forensic science
                                                        Health
                                                        Information technology
                                                        Infrastructure
                                                        Manufacturing
                                                        Materials
                                                        Mathematics and statisticsMetrology
                                                        Nanotechnology
                                                        Neutron research
                                                        Performance excellence
                                                        Physics
                                                        Public safety
                                                        Resilience
                                                        Standards
                                                        Transportation
            Publications
            Labs & Major Programs
        Laboratories
                                Communications Technology Laboratory
                                  Engineering Laboratory
                                  Information Technology Laboratory
                                  Material Measurement Laboratory
                                  Physical Measurement LaboratoryUser Facilities
                                NIST Center for Neutron Research
                                  CNST NanoFab
                                                        Research Test Beds
                                                        Research Projects
                                                        Tools & InstrumentsMajor Programs
                                Baldrige Performance Excellence Program
                                  CHIPS for America Initiative
                                  Manufacturing Extension Partnership (MEP)
                                  Office of Advanced Manufacturing
                                  Special Programs Office
                                  Technology Partnerships Office
            Services & Resources
        Standards and Measurements
                                Calibration Services
                                  Laboratory Accreditation (NVLAP)
                                  Quality System
                                  Standard Reference Materials (SRMs)
                                  Standards.gov
                                  Time Services
                                  Office of Weights and MeasuresSoftware
                                                        Data
                                Chemistry WebBook
                                  National Vulnerability Database
                                  Physical Reference Data
                                  Standard Reference Data (SRD)
                                                        Storefront
                                                        License & PatentsComputer Security Resource Center (CSRC)
                                                        NIST Research Library
            News & Events
        News
                                                        Events
                                                        Blogs
                                                        Feature Stories
                                                        AwardsVideo Gallery
                                                        Image Gallery
                                                        Media Contacts
            About NIST
        About Us
                                Leadership
                                  Organization Structure
                                  Budget & Planning
                                                        Contact Us
                                                        Visit
                                                        Careers
                                Student programsWork with NIST
                                                        History
                                NIST Digital Archives
                                  NIST Museum
                                  NIST and the Nobel
                                                        Educational Resources
 
 Information Technology Laboratory
      Executive Order 14028,  Improving the Nation's Cybersecurity
    
      
  Software Supply Chain Security Guidance
                            Expand or Collapse
          Software Security in Supply Chains
                                              Expand or Collapse
                Guidance, Purpose, Scope, and Audience
                                  EO-Critical Software and Security Measures for EO-Critical Software
                                  Software Cybersecurity for Producers and Users
                                                                Expand or Collapse
                      Attesting to Conformity with Secure Software Development Practices
                                  Software Verification
                                  Evolving Standards, Tools, and Recommended Practices
                                                                Expand or Collapse
                      Software Bill of Materials (SBOM)
                                              Enhanced Vendor Risk Assessments
                                              Open Source Software Controls
                                              Vulnerability Management
                                  Additional Existing Industry Standards, Tools, and Recommended Practices
                                  FAQs
                      Software Cybersecurity for Producers and Purchasers
                      Critical Software
                                              Expand or Collapse
                Critical Software Definition
                                                                Expand or Collapse
                      Introduction
                                              Background & Approach
                                              Definition & Explanatory Material
                                              FAQs
                                  Security Measures for Critical Software Use
                                                                Expand or Collapse
                      Introduction
                                              Purpose & Scope
                                              Security Measures for EO-Critical Software Use
                                              FAQs
                      Software Verification
                                              Expand or Collapse
                Introduction
                                  Background & Approach
                                  Recommended Minimum Standard for Vendor or Developer Verification of Code
                                  FAQs
          Cybersecurity Labeling for Consumers
                            Expand or Collapse
          Consumer Cybersecurity Labeling Pilots: The Approach and Contributions
                      Workshops on Cybersecurity Labeling of Consumer Products
                      IoT Product Criteria
                      Consumer Software Criteria
                      News & Updates
                      Engage
                      Resources
                      FAQs
          Workshops & Call for Papers
          News & Updates
          Engage
          Fact Sheet
          Resources
          FAQs
          Cybersecurity @ NISTCritical Software Definition - FAQs

Share
  Facebook
                      Linkedin
                      Twitter
                      Email

The following FAQs were compiled in consultation with OMB and CISA to provide additional context to the material.

**When will the next phase begin?***CISA and OMB will monitor the implementation of the program in the initial phase and decide when to include additional software categories.*

**What do you mean by “direct software****dependencies” in the definition?***For a given component or product, we mean other software components (e.g., libraries, packages, modules) that are directly integrated into, and necessary for operation of, the software instance in question. This is not a systems definition of dependencies and does not include the interfaces and services of what are otherwise independent products.*

**What do you mean by “critical to trust” in the definition?***“Critical to trust” covers categories of software used for security functions such as network control, endpoint security, and network protection.*

**Does it matter if the software product is in the cloud or in an on-premises or a hybrid environment?***No. If a product or service provides functions that are part of the definition of EO-critical, then the product or service itself is EO-critical, regardless of its deployment model. Having said that, NIST has recommended that the initial phase of the EO focus on on-premises software. Many on-premises products rely on cloud-based components and services that perform EO-critical functions (e.g., cloud-based access control). In such situations, the on-premises components are in scope if they directly perform EO-critical functions. It is suggested that cloud-based components and systems be addressed in later phases of implementation to allow time to coordinate with other Federal requirements for such systems (e.g., FedRAMP).*

**Can open source software be EO-critical?***Yes. If open source software performs functions that are defined as EO-critical, then it is EO-critical. In practice, open source software is often incorporated into other products.*

**Can Government-developed software be EO-critical?***Yes. The Federal Government develops software both in-house and through contracts. These products are often referred to as GOTS (government-off-the-shelf) software. If GOTS software performs functions included in the definition of EO-critical, then it is EO-critical.*

**What if a product is partly EO-critical and partly not?***If a product contains functions that are part of the definition of EO-critical, then the product itself is EO-critical. However, some EO-critical software products may contain distinct components that do not have EO-critical attributes or do not directly support the EO-critical functions provided by the product.*

**What if the software is purchased as a component of another product?***If a product performs functions that are part of the definition of EO-critical, then the product itself is EO-critical. When vendors attest to the implementation of the security measures under Section 4(e), they can specify which components of their products are covered. These may include components developed by other parties. For example, if the Government is buying a product that contains an operating system, the product is EO-critical and requires an attestation about the security measures, but the attestation can be limited to the operating system.**See FAQ #7*.

**How will this work with FedRAMP?***Section 3 of the EO addresses modernization of FedRAMP. The recommended phased approach starts with on-premises software, with the understanding that some on-premises software which relies on cloud-hosted components may be in scope. CISA will coordinate with FedRAMP to define the scope and applicability of the EO to cloud-based software in later phases of the implementation.*

**The definition excludes software that won’t be deployed in production systems for operational purposes. Can you provide more explanation?***There are several use cases where software is owned but is not deployed in a manner that would pose a significant risk of harm if compromised. Examples include software used as the subject of research and software collected for archival purposes.*

**What about software used in National Security Systems (NSS)? Are they covered?***Section 9 of the EO describes the applicability of the requirements of this EO to National Security Systems.*

**Can embedded software or firmware be EO-critical?***Yes. If embedded software or firmware performs functions that are defined as EO-critical, then it is EO-critical. Due to the complexities of such products, we recommended that such software not be included in the initial phase of implementation.*

**Shouldn’t departments and agencies decide what is EO-critical based on how the software is used to support the agency’s mission?***No. The definition of EO-critical is based on the functions of the software, not its use. The types of software defined by the table are likely to be EO-critical in most situations.*

**What about safety-critical or other high-assurance systems?***There are many types of safety-critical and other high-assurance systems. Many of them have regulatory or industry-based security requirements. If these systems make use of software that contains EO-critical functions, then that software is EO-critical. Safety-critical and high-assurance software and systems will have additional security requirements. For example, if a high-assurance system contains an operating system, the operating system is EO-critical and must meet the EO-critical requirements in addition to the safety-critical or other system requirements.*

**If I am using a software product that is not included in the EO-critical list, but it is critical for me, can I ask the vendor to provide attestation?***Yes, departments and agencies can leverage the EO-critical security measures defined in Section 4(e) as part of a procurement.*

**What is the difference between High Value Asset (HVA) systems and EO Critical Software usage?***A High Value Asset (HVA) is information or an information system that is so critical to an organization that the loss or corruption of this information or loss of access to the system would have serious impact to the organization's ability to perform its mission or conduct business. The HVA program focuses on the overarching system and the value it provides to the agency. EO Critical Software security measures are intended to protect the use of deployed EO-critical software in agencies' operational environments on-premises or in the cloud. The EO-Critical Software pinpoints the software that may feed into the HVA systems.
Some additional background on HVA:
An agency may designate Federal information or a Federal information system as an HVA when it relates to one or more of the following categories:*

*Informational Value - The information or information system that processes, stores, or transmits the information is of high value to the Government or its adversaries.*
	*Mission Essential - The agency that owns the information or information system cannot accomplish its Primary Mission Essential Functions (PMEF), as approved in accordance with Presidential Policy Directive 40 (PPD-40) National Continuity Policy, within expected timelines without the information or information system.*
	*Federal Civilian Enterprise Essential (FCEE) - The information or information system serves a critical function in maintaining the security and resilience of the Federal civilian enterprise.*

**Previous Sections:**

Introduction
	Background & Approach
	Definition & Explanatory Material
  Information technology and Cybersecurity

    
    Created June 24, 2021, Updated October 13, 2021
 HEADQUARTERS
            100 Bureau Drive
              Gaithersburg, MD 20899301-975-2000
            Webmaster | Contact Us | Our Other Offices
        Twitter
            
Facebook
            
LinkedIn
            
Instagram
            
YouTube
            
Giphy
            
RSS Feed
            
Mailing List
                              How are we doing? Feedback

  
  Site Privacy
                      Accessibility
                      Privacy Program
                      Copyrights
                      Vulnerability Disclosure
                      No Fear Act Policy
                      FOIA
                      Environmental Policy
                      Scientific Integrity
                      Information Quality Standards
                      Commerce.gov
                      Science.gov
                      USA.gov
                      Vote.gov