Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-attesting

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Executive Order 14028,  Improving the Nation's Cybersecurity

-  Software Supply Chain Security Guidance  Expand or Collapse    -  Software Security in Supply Chains  Expand or Collapse      -  Guidance, Purpose, Scope, and Audience 
    -  EO-Critical Software and Security Measures for EO-Critical Software 
    -  Software Cybersecurity for Producers and Users  Expand or Collapse        -  Attesting to Conformity with Secure Software Development Practices 
    -  Software Verification 
    -  Evolving Standards, Tools, and Recommended Practices  Expand or Collapse        -  Software Bill of Materials (SBOM) 
      -  Enhanced Vendor Risk Assessments 
      -  Open Source Software Controls 
      -  Vulnerability Management 
    -  Additional Existing Industry Standards, Tools, and Recommended Practices 
    -  FAQs 
  -  Software Cybersecurity for Producers and Purchasers 
  -  Critical Software  Expand or Collapse      -  Critical Software Definition  Expand or Collapse        -  Introduction 
      -  Background & Approach 
      -  Definition & Explanatory Material 
      -  FAQs 
    -  Security Measures for Critical Software Use  Expand or Collapse        -  Introduction 
      -  Purpose & Scope 
      -  Security Measures for EO-Critical Software Use 
      -  FAQs 
  -  Software Verification  Expand or Collapse      -  Introduction 
    -  Background & Approach 
    -  Recommended Minimum Standard for Vendor or Developer Verification of Code 
    -  FAQs 
-  Cybersecurity Labeling for Consumers  Expand or Collapse    -  Consumer Cybersecurity Labeling Pilots: The Approach and Contributions 
  -  Workshops on Cybersecurity Labeling of Consumer Products 
  -  IoT Product Criteria 
  -  Consumer Software Criteria 
  -  News & Updates 
  -  Engage 
  -  Resources 
  -  FAQs 
-  Workshops & Call for Papers 
-  News & Updates 
-  Engage 
-  Fact Sheet 
-  Resources 
-  FAQs 
-  Cybersecurity @ NIST 

# Software Security in Supply Chains: Attesting to Conformity with Secure Software Development Practices

## Share

Facebook

Linkedin

Twitter

Email

NIST’s attestation guidance in response to Section 4(e) outlines four minimum recommendations that software purchasers should require from suppliers. The guidance recognizes that there are instances in which “these minimum practices will not be sufficient”[1] due to agency-specific risk-based considerations.

SP 800-161, Rev. 1. outlines an array of such risk-based considerations that federal agency acquirers should consider when determining the appropriate degree of attestation from suppliers. Examples of risk-based considerations that demand more robust attestation include:
                  - Prospective suppliers under Foreign Ownership, Control, or Influence (FOCI), as outlined in Appendix E of SP 800-161, Rev. 1 (e.g., a supplier or its component suppliers have headquarters; research; development; manufacturing, testing, packaging, distribution, or service facilities; or other operations in a foreign country, including a country of special concern or a foreign adversary)
                  - Suppliers who provide mission-critical, life-safety, homeland security, critical infrastructure, or national security functions or an interdependency with another covered entity performing or essential to such functions
                  - Suppliers who support high value assets or a critical system component and that have been assessed by the agency to have a risk that is high relative to the use-case; assessed risk impact may or may not extend outside of the agency
                  - Suppliers who require the ability to access controlled unclassified information (CUI) or classified information
                  - Suppliers who represent a single source of supply with limited availability of (or acceptable alternatives to) the product, service, or source
                  - Suppliers who are frequently associated with foreign adversary tactics, techniques, and procedures (TTPs); security alerts; or threat intelligence reports

In these scenarios, federal agencies should consider enhancing attestation beyond the four minimum recommended practices outlined in Attesting to Conformity with Secure Software Development Practices guidance. Examples of enhanced attestation capabilities include:
                  - Supplier certifications, site visits, and/or third-party assessment and attestation
                  - Higher frequency and/or continuous monitoring of supplier adherence to attestation commitments
                  - Collection and review of lower-level artifacts, including functional and technical security controls
                  - Higher fidelity SBOMs, including vendor vulnerability disclosure reports at the component level

Federal agencies seeking more comprehensive attestation capabilities in higher risk scenarios should reference the evolving standards, tools, and practices guidance and Appendices D and E of SP 800-161, Rev.1.

[1] National Institute of Standards and Technology. (2022). Software Supply Chain Security Guidance Under Executive Order (EO) 14028 Section 4e. 

----

**Content:**
                  -  Introduction 
                  -  Guidance, Purpose, Scope, and Audience 
                  -  EO-Critical Software and Security Measures for EO-Critical Software 
                  -  Software Cybersecurity for Producers and Users                      -  Attesting to Conformity with Secure Software Development Practices
                  -  Software Verification 
                  -  Evolving Standards, Tools, and Recommended Practices                      -  Software Bill of Materials (SBOM) 
                    -  Enhanced Vendor Risk Assessments 
                    -  Open Source Software Controls 
                    -  Vulnerability Management
                  -  Additional Existing Industry Standards, Tools, and Recommended Practices 
                  -  Frequently Asked Questions (FAQs) 

Information technologyCybersecurity

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov