Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains/faqs

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Executive Order 14028,  Improving the Nation's Cybersecurity

-  Software Supply Chain Security Guidance  Expand or Collapse    -  Software Security in Supply Chains  Expand or Collapse      -  Guidance, Purpose, Scope, and Audience 
    -  EO-Critical Software and Security Measures for EO-Critical Software 
    -  Software Cybersecurity for Producers and Users  Expand or Collapse        -  Attesting to Conformity with Secure Software Development Practices 
    -  Software Verification 
    -  Evolving Standards, Tools, and Recommended Practices  Expand or Collapse        -  Software Bill of Materials (SBOM) 
      -  Enhanced Vendor Risk Assessments 
      -  Open Source Software Controls 
      -  Vulnerability Management 
    -  Additional Existing Industry Standards, Tools, and Recommended Practices 
    -  FAQs 
  -  Software Cybersecurity for Producers and Purchasers 
  -  Critical Software  Expand or Collapse      -  Critical Software Definition  Expand or Collapse        -  Introduction 
      -  Background & Approach 
      -  Definition & Explanatory Material 
      -  FAQs 
    -  Security Measures for Critical Software Use  Expand or Collapse        -  Introduction 
      -  Purpose & Scope 
      -  Security Measures for EO-Critical Software Use 
      -  FAQs 
  -  Software Verification  Expand or Collapse      -  Introduction 
    -  Background & Approach 
    -  Recommended Minimum Standard for Vendor or Developer Verification of Code 
    -  FAQs 
-  Cybersecurity Labeling for Consumers  Expand or Collapse    -  Consumer Cybersecurity Labeling Pilots: The Approach and Contributions 
  -  Workshops on Cybersecurity Labeling of Consumer Products 
  -  IoT Product Criteria 
  -  Consumer Software Criteria 
  -  News & Updates 
  -  Engage 
  -  Resources 
  -  FAQs 
-  Workshops & Call for Papers 
-  News & Updates 
-  Engage 
-  Fact Sheet 
-  Resources 
-  FAQs 
-  Cybersecurity @ NIST 

# Software Security in Supply Chains: Frequently Asked Questions

## Why is this guidance no longer a part of SP 800-161, Rev. 1?

NIST’s response to Executive Order (EO) 14028 Section 4(c) was initially developed and contained within Appendix F of SP 800-161, Rev. 1, *Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations*, to ensure that it received sufficient public comment and review within the EO-designated timelines. Though traceability with Appendix F remains in SP 800-161, Rev. 1, the content has been relocated online to:
                        - Allow for colocation with related EO 14028 guidance under NIST’s purview
                        - Enable updates to more areas of evolving guidance without directly impacting SP 800-161, Rev. 1 
                        - Provide traceability and linkage with other NIST web-based assets as and when they move online to encourage dynamic and interactive engagement with the public

## How does this guidance address Sections 4(c) and (d) of the EO 14028?

This guidance consolidates existing industry standards, tools, and recommended practices from NIST’s flagship Cybersecurity Supply Chain Risk Management (C-SCRM) guidance, SP 800-161, Rev. 1, as well as subsequent guidance published by NIST on its EO 14028, Improving the Nation’s Cybersecurity Guidance webpage. It also provides evolving standards, tools, and recommended practices from over 150 position papers submitted in advance of NIST’s June 2021 Enhancing Software Supply Chain Security Workshop, federal software supply chain security working groups, and an array of public and private industry partnerships. 

Executive Order (EO) 14028 Section 4(d) stipulates that the software supply chain security guidance and associated publications must be regularly maintained. NIST recognizes that this discipline is rapidly evolving and that many topics, capabilities, and guidance discussed herein will similarly evolve. As such, NIST will apply the policies and processes for the life cycle management of cryptographic standards and guidelines described in NISTIR 7977, *NIST Cryptographic Standards and Guidelines Development Process*, to guide the periodic review and updating of the guidelines described in Section 4(d) of EO 14028.

NIST’s Framework Update Process describes how NIST 1) continually and regularly engages in community outreach activities by attending and participating in meetings, events, and roundtable dialogs; 2) solicits direct feedback from industry through requests for information (RFI), requests for comments (RFC), and NIST team email; and 3) observes and monitors relevant resources and references – including descriptions of Framework use – published by government, academia, and industry. 

Together, NISTIR 7977 and the Framework Update Process illustrate the procedures that will be followed for periodic review and updating of the guidelines described in Section 4(d).

## I have software procurement-related responsibilities (e.g., acquisition and procurement officials, technology professionals) for my agency and suspect that I may need to provide enhanced attestation guidance based on the risk that a producer poses to m

**Full Question:  I have software procurement-related responsibilities (e.g., acquisition and procurement officials, technology professionals) for my agency and suspect that I may need to provide enhanced attestation guidance based on the risk that a producer poses to my agency. What guidance should I reference to adequately vet the purchaser?**

Consult SP 800-161, Rev. 1, Section 3 to contextualize attestation activities utilizing a risk-based approach. Additional guidance may be found in Appendix D in the form of vendor risk assessment templates and Appendix E, which expounds upon Foreign Ownership, Control, or Influence (FOCI) and other higher risk scenarios.

## How does one determine whether or not a supplier is under Foreign Ownership, Control, or Influence (FOCI)?

Per Appendix E of SP 800-161, Rev. 1, FOCI is defined as: 
> 
...ownership of, control of, or influence over the source or covered article(s) by a foreign interest (foreign government or parties owned or controlled by a foreign government, or other ties between the source and a foreign government) that has the power, direct or indirect, whether or not exercised, to direct or decide matters affecting the management or operations of the company.

## Where can I learn more about Cyber Supply Chain Risk Management (C-SCRM)?

See NIST’s flagship C-SCRM guidance, SP 800-161, Rev. 1. The publication’s broader C-SCRM control guidance, risk assessment approaches, and supplier templates further guide implementation and provide recommendations for organizations seeking to iteratively improve their C-SCRM programs. 

Information technologyCybersecurity

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov