Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/nist-now-analyzing-software-supply-chain

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Executive Order 14028,  Improving the Nation's Cybersecurity

-  Software Supply Chain Security Guidance  Expand or Collapse    -  Software Security in Supply Chains  Expand or Collapse      -  Guidance, Purpose, Scope, and Audience 
    -  EO-Critical Software and Security Measures for EO-Critical Software 
    -  Software Cybersecurity for Producers and Users  Expand or Collapse        -  Attesting to Conformity with Secure Software Development Practices 
    -  Software Verification 
    -  Evolving Standards, Tools, and Recommended Practices  Expand or Collapse        -  Software Bill of Materials (SBOM) 
      -  Enhanced Vendor Risk Assessments 
      -  Open Source Software Controls 
      -  Vulnerability Management 
    -  Additional Existing Industry Standards, Tools, and Recommended Practices 
    -  FAQs 
  -  Software Cybersecurity for Producers and Purchasers 
  -  Critical Software  Expand or Collapse      -  Critical Software Definition  Expand or Collapse        -  Introduction 
      -  Background & Approach 
      -  Definition & Explanatory Material 
      -  FAQs 
    -  Security Measures for Critical Software Use  Expand or Collapse        -  Introduction 
      -  Purpose & Scope 
      -  Security Measures for EO-Critical Software Use 
      -  FAQs 
  -  Software Verification  Expand or Collapse      -  Introduction 
    -  Background & Approach 
    -  Recommended Minimum Standard for Vendor or Developer Verification of Code 
    -  FAQs 
-  Cybersecurity Labeling for Consumers  Expand or Collapse    -  Consumer Cybersecurity Labeling Pilots: The Approach and Contributions 
  -  Workshops on Cybersecurity Labeling of Consumer Products 
  -  IoT Product Criteria 
  -  Consumer Software Criteria 
  -  News & Updates 
  -  Engage 
  -  Resources 
  -  FAQs 
-  Workshops & Call for Papers 
-  News & Updates 
-  Engage 
-  Fact Sheet 
-  Resources 
-  FAQs 
-  Cybersecurity @ NIST 

# NIST Now Analyzing Software Supply Chain Workshop Discussions, Position Papers

## Share

Facebook

Linkedin

Twitter

Email

More than 1400 participants took part in the June 2-3, 2021, National Institute of Standards and Technology (NIST) workshop on enhancing the security of the software supply chain. That workshop helps to fulfill the President’s Executive Order onImproving the Nation’s Cybersecurity (14028), issued on May 12, 2021.  

NIST now is reviewing and analyzing the discussions at that virtual workshop, including questions and answers offered by panelists and in a lively exchange in the “chat” feature which maximized participants’ engagement. Key points made during those four panels included:
                  - *Panel 1 – Criteria for Designating Critical Software*                      - Limit the scope of critical software; if everything is critical, nothing is critical.
                    - A phased approach will help make the program successful.
                    - Consideration should be given to the diversity of the software marketplace.
                  - *Panel 2 – Secure Software Development Standards, Practices, and Conformance.*                      - A flexible, outcome-based approach to secure software development is necessary to accommodate the range of environments, platforms, languages, protocols, etc.
                    - When generating artifacts for demonstrating conformance with secure software development practices, software suppliers should strive for transparency, accountability, auditability, and immutability.
                    - NIST’s Secure Software Development Framework (SSDF) already includes many of the practices needed to meet the EO requirements and maps to numerous existing standards and guidelines.
                  - *Panel 3– Tools and Techniques for Testing Software*                      - Threat modeling should initially drive testing goals and plans.
                    - Use static analysis, that is, automatic code examination for bugs or suspicious pattern, in addition to executing test cases.
                    - Choose languages, architectures, protocols, etc. for which a mathematical proof can be constructed that the software will behave as intended.
                    - Fuzzing is valuable because the cost in human resources is low and it tends to exercise bizarre cases that had not been considered.
                    - At least one developer should have security training: specifically, a course where they had to break into a program.
                  - *Panel 4– Security Measures for Critical Software*                      - Organizations (agencies) should be conducting basic “cyber hygiene” regardless of the definition of critical software, including practices stated in the EO (least privilege, network segmentation, and proper configuration), but also others such as authentication, patching, vulnerability management, logging, and network security.
                    - Even with a definition of critical software and the DHS list of categories, organizations (agencies) will still need to implement a risk-based approach and apply context-driven activities, such as conducting or utilizing criticality analysis.

Presenters at the workshop were selected based on the nearly 150 position papers submitted. NIST also is reviewing each of those position papers in detail as it aims to meet requirements of Section 4 of the Executive Order. That order directs the Secretary of Commerce, through NIST, to consult with federal agencies, the private sector, academia, and other stakeholders in identifying standards, tools, best practices, and other guidelines to enhance software supply chain security. NIST is assigned tight deadlines for establishing those standards and guidelines – which will be used by other agencies to govern the federal government’s procurement of software.

Additional information is available on a dedicated NIST website. Inquiries may be directed to: swsupplychain-eo [at] nist.gov (swsupplychain-eo[at]nist[dot]gov)

Information technologyCybersecurity

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov