Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-enhanced

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Executive Order 14028,  Improving the Nation's Cybersecurity

-  Software Supply Chain Security Guidance  Expand or Collapse    -  Software Security in Supply Chains  Expand or Collapse      -  Guidance, Purpose, Scope, and Audience 
    -  EO-Critical Software and Security Measures for EO-Critical Software 
    -  Software Cybersecurity for Producers and Users  Expand or Collapse        -  Attesting to Conformity with Secure Software Development Practices 
    -  Software Verification 
    -  Evolving Standards, Tools, and Recommended Practices  Expand or Collapse        -  Software Bill of Materials (SBOM) 
      -  Enhanced Vendor Risk Assessments 
      -  Open Source Software Controls 
      -  Vulnerability Management 
    -  Additional Existing Industry Standards, Tools, and Recommended Practices 
    -  FAQs 
  -  Software Cybersecurity for Producers and Purchasers 
  -  Critical Software  Expand or Collapse      -  Critical Software Definition  Expand or Collapse        -  Introduction 
      -  Background & Approach 
      -  Definition & Explanatory Material 
      -  FAQs 
    -  Security Measures for Critical Software Use  Expand or Collapse        -  Introduction 
      -  Purpose & Scope 
      -  Security Measures for EO-Critical Software Use 
      -  FAQs 
  -  Software Verification  Expand or Collapse      -  Introduction 
    -  Background & Approach 
    -  Recommended Minimum Standard for Vendor or Developer Verification of Code 
    -  FAQs 
-  Cybersecurity Labeling for Consumers  Expand or Collapse    -  Consumer Cybersecurity Labeling Pilots: The Approach and Contributions 
  -  Workshops on Cybersecurity Labeling of Consumer Products 
  -  IoT Product Criteria 
  -  Consumer Software Criteria 
  -  News & Updates 
  -  Engage 
  -  Resources 
  -  FAQs 
-  Workshops & Call for Papers 
-  News & Updates 
-  Engage 
-  Fact Sheet 
-  Resources 
-  FAQs 
-  Cybersecurity @ NIST 

# Software Security in Supply Chains: Enhanced Vendor Risk Assessments

## Share

Facebook

Linkedin

Twitter

Email

The EO creates higher standards for software verification techniques and other software supply chain controls. Therefore, additional scrutiny is being placed on the software that the vendors produce, as well as the business entities within a given software supply chain that may sell, distribute, store, or otherwise have access to the software code. Federal agencies that seek to enhance their assessment of supplier software supply chain controls can perform additional scrutiny on vendor SDLC capabilities, security posture, and risks associated with Foreign Ownership, Control, or Influence (FOCI).

The following capabilities provide recommended vendor risk assessment and attestation capabilities beyond those outlined in Section 4 of EO 14028:

## **Foundational Capabilities**

                  - Assess and analyze vendors who utilize open source data and (as resources permit) commercially available third-party assessment and security ratings platforms. Acquirers with access to confidential information may further supplement these outside-in analyses.  
                  - Require vendors to periodically self-attest to adopting practices that conform to the applicable requirements of  SSDF V1.1 , such as Produce Well-Secured Software’s (PW)  Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements .
                  - Automatically verify hashes/signatures for all vendor-supplied software installation and updates, where feasible. [1]

## **Sustaining Capabilities**

                  - Require vendors to submit third-party attestation that they conform to the applicable requirements of SSDF V1.1.
                  - Extend foundational capability recommendations to subsidiary suppliers designated within outside-in analyses and/or SBOMs, to the extent feasible.
                  - Include flow-down requirements to sub-tier suppliers in agreements that pertain to the secure development, delivery, operational support, and maintenance of software.
                  - Prioritize or mandate the use of suppliers who provide a software security label or data sheet that should include information about the software itself, the tools and technologies used to build the software, security standards and controls, the tools and processes that govern the software, and information on the qualifications and skills of key personnel involved in building the software for all provided products, where possible. [2]

## **Enhancing Capabilities**

                  - Require vendors to periodically submit third-party attestation that they conform to the applicable requirements of SSDF V1.1 and the enhancing SSDLC capabilities (e.g., automated build deployments, pre-production testing, automatic rollbacks, and staggered production deployments), including low-level artifacts where feasible and appropriate. [3]
                  - Enforce just-in-time credentials for supplier build systems. [4]

[1] Enduring Security Framework. (2021). User Group’s Overview of the Top Supply Chain Threats. https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/Cybersecurity-Partnerships/ESF/

[2] Contrast Security. (2021). 5. Guidelines for software integrity chains and provenance. 

[3] Amazon Web Services. (2021). NIST June 2021 EO Workshop Submission. 

[4] Enduring Security Framework. (2021). User Group’s Overview of the Top Supply Chain Threats. https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/Cybersecurity-Partnerships/ESF/

----

**Content:**
                  -  Introduction 
                  -  Guidance, Purpose, Scope, and Audience 
                  -  EO-Critical Software and Security Measures for EO-Critical Software 
                  -  Software Cybersecurity for Producers and Users                      -  Attesting to Conformity with Secure Software Development Practices
                  -  Software Verification 
                  -  Evolving Standards, Tools, and Recommended Practices                      -  Software Bill of Materials (SBOM) 
                    -  Enhanced Vendor Risk Assessments 
                    -  Open Source Software Controls 
                    -  Vulnerability Management
                  -  Additional Existing Industry Standards, Tools, and Recommended Practices 
                  -  Frequently Asked Questions (FAQs) 

Information technologyCybersecurity

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov