As contemplated by PilieroMazza’s recent blog, the Cybersecurity and Infrastructure Security Agency (CISA) released a notice and request for comments on a new requirement for software producers to provide self-attestations regarding their software and its compliance with the secure software development practices, as described in the National Institute of Standards and Technology (NIST) Secure Software Development Framework (SSDF) (Special Publication 800–218). The Office of Management and Budget released a memorandum on September 14, 2022, requiring agencies obtain self-attestations from software producers before using their software. A draft version of the self-attestation form (Form) can be found here. Government contractors that produce and provide software to the government should become familiar with notable contents in the self-attestations, as described further below.
Who Is Required to Complete Attestations?
The term “software producer” is not defined but, on its face, it encompasses all firms that produce or develop software. These attestations will be required for:
Park Filed Complaint Against President Lee Ahead of 2021 Election Jang Youngha Sentenced to One Year in Prison, Two Years Probation Confirmed The police have launched an investigation into Park Chu...