May 22, 2022

Volume XII, Number 142

Advertisement
Advertisement

May 20, 2022

Subscribe to Latest Legal News and Analysis

May 19, 2022

Subscribe to Latest Legal News and Analysis
Advertisement

NIST Releases Guidance on Supply Chain Security

The National Institutes of Science and Technology (NIST) Information Technology Laboratory recently released guidance entitled “Software Supply Chain Security Guidance,” in response to directives set forth in President Biden’s Executive Order 14028—Improving the Nation’s Cybersecurity.

The guidance refers to existing industry standards, tools, and recommended practices that were previously published by NIST in SP800-161 “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.”  It is designed for federal agencies that “acquire, deploy, use, and manage software from open source projects, third-party suppliers, developers, system integrators, external system service providers, and other information and communications technology (ICT)/operational technology (OT)-related service providers,” but is certainly applicable and helpful to any organization grappling with how to manage third-party software vulnerabilities after the SolarWinds incident.

The guidance walks readers through software cybersecurity for producers and users using the secure software development framework and the process by which NIST gathered evolving standards, tools, and recommended practices to address software supply chain security. The recommended practices include:

  • Ensuring that suppliers of software products and services are able to produce a Software Bill of Materials (SBOM)

  • Enhanced Vendor Risk Assessments

  • Implementing Open Source Software Controls

  • Vulnerability Management

NIST publications offer relevant and easy to understand cybersecurity guidance. With the increase we have seen in zero-day vulnerabilities and continued risk of attacks by Russia and China, this is a worthwhile and timely read.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XII, Number 132
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence
Partner

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...

401-709-3353
Advertisement
Advertisement
Advertisement