A Critical Step: NIST Defines "Critical Software" Subject To Biden's Cybersecurity Order

On June 25, 2021, the National Institute of Standards and Technology (NIST) published a definition of "critical software," the first of several steps the Biden administration is taking to enhance the cybersecurity of America's software supply chain under the recent Executive Order on Improving the Nation's Cybersecurity (the Order or E.O.). In addition to providing this crucial definition, the NIST publication includes a preliminary list of "software and software products" that may qualify as "critical" under the Order and responses to a series of Frequently Asked Questions (FAQs). 

The NIST publication is significant for federal contractors and other companies that offer and sell software for use by the U.S. government because under the Order, "critical software" will soon be subject to heightened development and transparency standards and eventually will be banned from use by federal agencies if the software does not meet those standards. Below we discuss the key