Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-open

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Executive Order 14028,  Improving the Nation's Cybersecurity

-  Software Supply Chain Security Guidance  Expand or Collapse    -  Software Security in Supply Chains  Expand or Collapse      -  Guidance, Purpose, Scope, and Audience 
    -  EO-Critical Software and Security Measures for EO-Critical Software 
    -  Software Cybersecurity for Producers and Users  Expand or Collapse        -  Attesting to Conformity with Secure Software Development Practices 
    -  Software Verification 
    -  Evolving Standards, Tools, and Recommended Practices  Expand or Collapse        -  Software Bill of Materials (SBOM) 
      -  Enhanced Vendor Risk Assessments 
      -  Open Source Software Controls 
      -  Vulnerability Management 
    -  Additional Existing Industry Standards, Tools, and Recommended Practices 
    -  FAQs 
  -  Software Cybersecurity for Producers and Purchasers 
  -  Critical Software  Expand or Collapse      -  Critical Software Definition  Expand or Collapse        -  Introduction 
      -  Background & Approach 
      -  Definition & Explanatory Material 
      -  FAQs 
    -  Security Measures for Critical Software Use  Expand or Collapse        -  Introduction 
      -  Purpose & Scope 
      -  Security Measures for EO-Critical Software Use 
      -  FAQs 
  -  Software Verification  Expand or Collapse      -  Introduction 
    -  Background & Approach 
    -  Recommended Minimum Standard for Vendor or Developer Verification of Code 
    -  FAQs 
-  Cybersecurity Labeling for Consumers  Expand or Collapse    -  Consumer Cybersecurity Labeling Pilots: The Approach and Contributions 
  -  Workshops on Cybersecurity Labeling of Consumer Products 
  -  IoT Product Criteria 
  -  Consumer Software Criteria 
  -  News & Updates 
  -  Engage 
  -  Resources 
  -  FAQs 
-  Workshops & Call for Papers 
-  News & Updates 
-  Engage 
-  Fact Sheet 
-  Resources 
-  FAQs 
-  Cybersecurity @ NIST 

# Software Security in Supply Chains: Open Source Software Controls

## Share

Facebook

Linkedin

Twitter

Email

As stated in the EO, “ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software components used within any portion of a product[1]” is a central driver behind many flagship initiatives like the SBOM. Though organizations should enforce formal baseline software supply chain security controls regardless of where and how code is developed, the risks of using open source or community-developed software are unique. Open source projects are diverse, numerous, and use a wide range of operating models. Many of these projects’ provenance, integrity, support maintenance, and other underlying functions are not well understood or easy to discover and vary from one project to the next.

Open source software components are pervasive, and federal agencies should understand their suppliers’ usage of open source software components by considering the capabilities recommended below.

## **Foundational Capabilities**

                  - Utilize Protect the Software (PS) and Respond to Vulnerabilities (RV) guidance in SSDF V1.1 to identify any publicly known vulnerabilities of supplied open source software components (e.g., Software Composition Analysis [SCA]).
                  - Apply procedural and technical controls to ensure that open source software components are acquired via secure channels from trustworthy repositories. [2]

## **Sustaining Capabilities**

                  - Supplement SCA source code-based reviews with binary software composition analyses to identify vulnerable components in supplied binaries or images that could have been introduced during build and run activities to ascertain whether (e.g., newly discovered) vulnerabilities are applicable to the end product and to verify the contents of the end product (including verifying the applied compiler options) prior to “shipping.” These tools can also be utilized to determine whether in-house developed codebases leverage vulnerable open source software components. [3]
                  - Set up and maintain one or more repositories and/or libraries of open source software components that developers may utilize as part of a robust continuous integration continuous delivery (CI/CD) pipeline, in accordance with SSDF V1.1. This can include a repository to host sanctioned and vetted open source components.

## **Enhancing Capabilities**

                  - Prioritize the use of programming languages and frameworks that have built-in guardrails to proactively mitigate common types of vulnerabilities. [4]
                  - Automate the pipeline of collecting, storing, and scanning open source software components to designated, hardened internal repositories and/or sandboxes prior to introduction into development environments.

[1] Executive Office of the President. (2021). Executive Order 14028 on Improving the Nation's Cybersecurity. https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity

[2] Broadcom and Symantec (A Division of Broadcom). (2021). Position Paper on Standards and Guidelines to Enhance Software Supply Chain Security. 

[3] BlackBerry. (2021). Position Paper Secure Software Development Environment and Testing Software Code. 

[4] Google. (2021). High-Confidence, Scalable Secure Development. 

----

**Content:**
                  -  Introduction 
                  -  Guidance, Purpose, Scope, and Audience 
                  -  EO-Critical Software and Security Measures for EO-Critical Software 
                  -  Software Cybersecurity for Producers and Users                      -  Attesting to Conformity with Secure Software Development Practices
                  -  Software Verification 
                  -  Evolving Standards, Tools, and Recommended Practices                      -  Software Bill of Materials (SBOM) 
                    -  Enhanced Vendor Risk Assessments 
                    -  Open Source Software Controls 
                    -  Vulnerability Management
                  -  Additional Existing Industry Standards, Tools, and Recommended Practices 
                  -  Frequently Asked Questions (FAQs) 

Information technologyCybersecurity

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov