Overview
Government contractors will soon need to
attest that the software they produce is securely developed. On
April 27, 2023, the Cybersecurity and Infrastructure Security
Agency (CISA) published a draft Secure Software Self-Attestation
Form and Request for Comment. The CISA form defines the four secure
development objectives that set the baseline expectation for all US
government-procured software products and services. Government
software producers, developers and resellers should act now to
validate their secure development practices and prepare to make and
defend legally binding attestations.
In Depth
Government software producers have known for nearly two years
that the federal government would soon require secure software
development attestations aligned with the National Institute of
Standards and Technology (NIST) Secure Software Development
Framework (SSDF). However, until recently, government software
producers had little insight into how the
