| [open-regulatory-compliance] Now that technical standards work has been initiated - some material for consideration |
Hello Everyone, Now that the EU CRA Technical Standards work has begun I wanted to share some information for consideration. This is not a proposal, it is simply to raise awareness of some existing technical recommendations for software manufacturers to follow when selling products to the US Government produced in a public-private partnership under DHS CISA by the ICT_SCRM Task Force membership; https://www.cisa.gov/ict-scrm-task-force-members Additional information is provided by the US NASA regarding their SCRM software risk assessment processing expectations: https://www.nasa.gov/secure-software-development-self-attestation-resources-and-knowledge/ The EU CRA identifies technical expectations such as SBOM and vulnerability disclosure reporting, which overlap with expectations identified by the US CISA organization for Secure by Design and Secure by Default implementations in its Software Acquisition Guide for US Federal Agencies to procure and use only trustworthy software products. https://cisa.gov/sag With regard to SBOM requirements:
With regard to Vulnerability Management requirements, including before a product is released to market and ongoing notifications:
The CISA spreadsheet artifact was designed to acquire software vendor insights into Secure by Design and Secure by Default technical practices followed by a software supplier. Thanks, Dick Brooks
Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council – A Public-Private Partnership Never trust software, always verify and report! ™ Risk always exists, but trust must be earned and awarded.™ https://businesscyberguardian.com/ Email: dick@xxxxxxxxxxxxxxxxxxxxxxxxx Tel: +1 978-696-1788 |
