Call us now:
Has the White House memo released yesterday requiring Federal departments to ensure that all third-party IT Software deployed adheres to NIST Supply Chain security requirement opened up a whole can of trouble for software vendors that supply Federal Government? (https://lnkd.in/eH9jwHZH)
The memo is written under the scope of FISMA, as required by all Federal agencies and the Software Supply Chain Guidance under EO 14028 that references the requirement to use NIST guidance. NIST Guidance that is contained in NIST SP 800-218 and the NIST Software Supply Chain Security Guidance. That reference NIST SP 800-218, IS/ IEC 17000, NISTIR 7692, NIST SP 800-160vol1 and 161r1.
Self attestation is the minimum requirement, with agencies able to make a risk based determination that a third party assessment is required. But self attesting compliance creates its own issues as the guidance makes reference to various NIST publications and complying to the memo does not look to be easy. The guidance specifically references adopting a risk based approach for secure software development by Federal Agencies and software vendors throughout the software lifecycle.
Self attestation sets the minimum bar for compliance and will be fraught with challenges for national and international software developers, requiring a close relationship with General Counsel. The direction of travel for software supply chain security and cybersecurity is one of regulatory compliance underpinned by regulatory enforcement. The SolarWinds hack taught many about the breadth and depth of cyber attacks embedded in the software supply chain and the Twitter Senate hearing has exposed gaps in cybersecurity compliance.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #softwaredevelopment #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6976175309783973888