The White House issued a memorandum that requires each federal agency to comply with the NIST Guidance when using third-party software on the agency�

White House guidance requires agencies to inventory all software in 90 days

submited by

Style Pass

2022-09-21 15:30:21

The White House issued a memorandum that requires each federal agency to comply with the NIST Guidance when using third-party software on the agency’s information systems and to inventory all software subject to its requirements within 90 days.

As part of the new guidance that follows the executive order “ Improving the Nation’s Cybersecurity ” issued in May last year, federal agencies must only use software provided by software producers who can attest to complying with the Government-specified secure software development practices. Otherwise, a third-party assessment can be provided by a certified FedRAMP Third Party Assessor Organization (3PAO) or one approved by the agency.

Also, a Software Bill of Materials may be required by the agency in solicitation requirements, based on how critical the software is The SBOMs must be generated in one of the data formats defined in the National Telecommunications and Information Administration (NTIA) report “The Minimum Elements for a Software Bill of Materials (SBOM).”

Agency CIOs will need to assess training needs and develop training plans for the review and validation of software attestations and artifacts within 180 days.