NIST Publishes 'Critical Software' Security Guidance

guest · Jul 21, 2021

NIST Publishes 'Critical Software' Security Guidance
July 21, 2021
https://www.bankinfosecurity.com/nist-publishes-critical-software-security-guidance-a-17117

New guidance from the National Institute of Standards and Technology spells out security measures for "critical software" used by federal agencies and minimum standards for testing its source code. The best practices could be a model for the private sector as well.

In developing the new guidelines, NIST worked with the Cybersecurity and Infrastructure Security Agency, Office of Management and Budget, and the National Security Agency, and gathered input via workshop, which included 1,000 participants from industry, academia and government.

Barbara Guttman, leader of NIST's software quality group, says the new guidance is crucial as the country takes steps to address its cyber resiliency.
OMB will enforce agencies' compliance with the guidance.
Click to expand...

Standards for Software Testing
In addition to its security measures, NIST published minimum standards for the testing of critical software by developers.

"The software must be designed, built, delivered and maintained in accordance with best practices," the agency writes. "Frequent and thorough testing by developers as early as possible in the software development life cycle is one critical practice."
Click to expand...

NIST: Security Measures for “EO-Critical Software” Use Under Executive Order (EO) 14028 - Guidance Purpose & Scope

The scope of this guidance on security measures is federal agency use of EO-critical software. Development and acquisition of EO-critical software are out of scope. The security measures are intended to protect the use of deployed EO-critical software in agencies’ operational environments.
Click to expand...

NIST: Recommended Minimum Standards for Vendor or Developer Verification (Testing) of Software Under Executive Order (EO) 14028 - Background & Approach

This webpage summarizes minimum standards recommended for verification by software vendors or developers. No single verification standard can encompass all types of software testing, be specific and prescriptive, and present efficient and effective testing. Thus, this document recommends high-level guidelines for software producers to create their own prescriptive processes.
Click to expand...

Log in or Sign up

NIST Publishes 'Critical Software' Security Guidance

guest Guest

Log in or Sign up

NIST Publishes 'Critical Software' Security Guidance

guest Guest

Useful Searches