May 5, 2022 - Section 4 of the EO directs NIST to solicit input from the private sector, academia, government agencies, and others and to identify existing or develop new standards, tools, best practices, and other guidelines to enhance software supply chain security. Those guidelines are to include: ... Based on more than 150 responses to a call for position papers, multiple workshops, and responses to draft documents, NIST has produced a series of guidance resources.

November 1, 2024 - To support the prioritization and practical implementation of evolving software supply chain security recommendations, guidance is presented in the Foundational, Sustaining, and Enhancing practices paradigm in SP 800-161r1.

February 4, 2022 - Executive Order (EO) 14028 on Improving the Nation’s Cybersecurity, May 12, 2021, directs the National Institute of Standards and Technology (NIST) to publish guidance on practices for software supply chain security. This document starts by explaining NIST’s approach for addressing Section 4e.

March 11, 2026 - It provides a foundation that organizations can build upon to address emerging threats and challenges in the software supply chain. NIST provides guidance on incorporating AI and ML into cybersecurity practices.

September 13, 2023 - NIST is signaling they want to help move the goal in how the industry should approach software supply chain security. In this instance by emphasizing CI/CD pipelines, NIST is highlighting the importance of the processes that drive software development and deployment, rather than just the end product. While there’s no shortage of guidance on CI/CD pipelines, much of the existing literature is either outdated or too narrow in scope.

Supply chain security measures also apply to controls during the CD process. The following are · some due diligence measures that should be used during CD. These measures can be · implemented by defining verification policies for allowing or disallowing an artifact for ... Application with Service Mesh. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-204C.

January 14, 2026 - We recommend using a formal Cyber-Supply Chain Risk Management (C-SCRM) approach teamed with a Secure Software Development Framework (SSDF) to more effectively identify, assess, and mitigate risks.

February 3, 2025 - The revised publication, formally titled Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST Special Publication 800-161 Revision 1), provides guidance on identifying, assessing and responding to cybersecurity ...

June 29, 2022 - Leveraging commercially-available tools like security ratings ... The NIST guidance was required from the May 2021 U.S. Executive Order (EO) on Improving the Nation’s Cybersecurity. The EO includes provisions designed to improve software supply chain security, including methods to reduce vulnerabilities in the software developed, as well as the cybersecurity practices of the software developers and suppliers themselves.

May 16, 2025 - The latest release comes from the US National Institute of Standards and Technology (NIST), in its special publication 800-204, also known as “Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines.”

NIST guidelines emphasize identifying critical suppliers, securing development environments, assessing third-party software, and maintaining a thorough incident response plan. These documents serve as foundational resources for aligning with ...

February 4, 2022 - 1 (Second Draft), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. Are any other parts of EO 14028 related to this guidance? Yes. Section 4n references section 4k, which was discussed in the introduction to ...

In May 2022, NIST provided additional, comprehensive guidance in "Software Security in Supply Chains" related to the "acquisition, use, and maintenance of third-party software." The guidance also offered recommended concepts and capabilities ...

No matter the size or reputation of a prospective software vendor, it's always a good idea to conduct some form of security vetting. The SolarWinds breach was certainly a reminder of that. As a starting point, requesting a software bill of materials can help organizations gain visibility into potential vulnerabilities — we highlighted several benefits of consuming SBOMs earlier in this guide. NIST's publication on the minimum required elements of an SBOM offers a good baseline as to the type of data that should be included. (However, NIST's guidance is only mandatory for organizations selling into the U.S.

May 31, 2023 - Anyone else mildly confused by the executive order from Biden, where Federal Agencies need to comply with NIST 800-218? Reading through all of the documentation, I am stuck on if we as a "software" company need to comply and/or the software we use to develop our software needs to comply...

May 5, 2022 - These risks are associated with ... and services. This publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations....

NIST’s foundational C-SCRM guidance, SP 800-161, Rev. 1, Cybersecurity · Supply Chain Risk Management Practices for Systems and Organizations; ... NIST’s EO webpage. To support the prioritization and practical implementation of evolving software supply · chain security recommendations, guidance is presented in the Foundational, Sustaining,

February 4, 2022 - NIST promotes U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

August 12, 2024 - In addition to the enhanced scrutiny ... the following: “Perform additional scrutiny on vendor SDLC capabilities, security posture, and risks associated with Foreign Ownership, Control, or Influence; Requiring vendors to ...

May 5, 2022 - NIST is publishing guidance identifying practices that enhance the security of the software supply chain as part of its assignments to enhance the security of the software supply chain called for by a May 12, 2021, Presidential Executive Order ...