Call us now:
The US government overwhelmingly passed a bill requiring covered software suppliers to the Department of Homeland Security (DHS) submit a Software Bill of Materials (BoM) and certification that their products are free from vulnerabilities and defects. The DHS Software Supply Chain Risk Management Act (2021) was introduced in response to the recent SolarWinds attack. (https://lnkd.in/d_sZXDiG)
Section (e) of the bill is an important consideration for covered companies that supply software to the DHS. Requiring-
(1) A certification that each item listed on the submitted BoM is free from all known vulnerabilities or defects affecting the security of the end product or service identified in
(A) the National Institute of Standards and Technology National Vulnerability Database; and
(B) any database designated by the Under Secretary, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, that tracks security vulnerabilities and defects in open source or third-party developed software.
(2) A notification of each vulnerability or defect affecting the security of the end product or service, if identified, through-
(a) the certification of such submitted bill of materials required under paragraph (1); or
(b) any other manner of identification.
(3) A notification relating to the plan to mitigate, repair, or resolve each security vulnerability or defect listed in the notification required under paragraph (2).
This is a prime example of the US legislative process working to address cybersecurity and cyber risk.
Ted Dziekanowski‚Â Brian McCarthy‚Â Jason Spezzano
#ransomware‚Â #fisma‚Â #ofac‚Â #theaugustagroup‚Â #theaugustaplan‚Â #cybersecurity‚Â #supplychainriskmanagement‚Â #cyberriskmanagement‚Â #compliance‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #esg‚Â #scrm‚Â #cscrm‚Â #fca‚Â #cybercompliance‚Â #cyberregulation‚Â #cybergovernance‚Â #falseclaimsact #SDLC #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6856843554220724225