On May 12, 2021 the Biden Administration issued an “Executive Order on Improving the Nation’s Cybersecurity” (EO).  Among other things, the EO sets out a list of deliverables from a variety of government entities.  A number of these deliverables were due in June, including a definition of “critical software,” the minimum requirements for a software bill of materials, and certain internal actions imposed on various federal agencies.

Developments Affecting Enhancement of Software Supply Chain Security

Definition of Critical Software.  Section 4 of the EO stated that the “development of commercial software often lacks transparency, sufficient focus on the ability of the software to resist attack, and adequate controls to prevent tampering by malicious actors.”  The EO cites a “pressing need” for mechanisms to ensure the “security and integrity” of “critical software.”  The EO broadly defines critical software as “software that performs functions critical to trust” and tasks the Secretary of Commerce, through the National Institute of Standards and Technology (NIST) to develop a definition of critical software that could be used in forthcoming regulations and guidance – including guidance required by the EO on identifying practices that enhance the security of the software supply chain.

On June 25, 2021, NIST issued a white paper providing a definition of critical software.  The white paper followed a workshop that NIST held on June 2-3, 2021 with over 1400 participants and 150 position papers submitted for NIST’s consideration.  In addition to private industry, NIST solicited input from the public as well as reportedly from several government agencies – including the Cybersecurity and Infrastructure Security Agency, the Office of Management and Budget (OMB), the Office of the Director of National Intelligence (ODNI) and the National Security Agency – to help define what critical software means.

NIST’s definition is broad and defines critical software as

any software that has or has direct software dependencies upon, one or more components with at least one of these attributes:

  • Software that is designed to run with elevated privilege or manage privileges;
  • Software that has direct or privileged access to networking or computing resources;
  • Software that is designed to control access to data or operational technology;
  • Software that performs a function critical to trust; or operates outside of normal trust boundaries with privileged access.

According to NIST, this definition preliminarily includes operating systems, web browsers, hypervisors, endpoint security tools, identity and access management applications, network monitoring tools, backup, recovery, and remote storage tools, and other categories of software.

In explaining the definition, NIST expressed its view that the EO’s implementation “must take into consideration how the software industry functions, including product development, procurement, and deployment.”  Further, NIST explained that the term “critical” as used in the EO is not based not on the context of use, “but instead focuses on critical functions that address underlying infrastructure for cyber operations and security.”  Some limited use cases – such as software solely used for research or testing that is not deployed in production systems – are outside of the scope of this definition.

Finally, although the definition applies to all forms of software, NIST recommends that the initial EO implementation phase focus on standalone, on-premises software that has security-critical functions or poses similar significant potential for harm if compromised.  NIST indicated that later implementation of the EO could expand to other forms of software such as software that controls access to data, cloud-based and firmware to name a few.

Other Developments

Software Bill of Materials Minimum Requirements. Section 4(f) of the EO requires the National Telecommunications and Information Administration (NTIA) to publish the minimum elements of a Software Bill of Materials (SBOM), which the EO defines as “a formal record containing the details and supply chain relationships of various components used in building [the] software.”  In preparing to meet the July 11, 2021 deadline for publishing the minimum elements for SBOMs, NTIA issued a request for public comment on the minimum elements for SBOMs and the factors that should be considered in requesting, producing, distributing, and consuming such items.

NTIA’s request notes that an SBOM is similar to a “list of ingredients” and thereby promotes transparency in the software supply chain.  NTIA proposed a definition of the minimum elements of an SBOM that encompasses three broad, inter-related features: (1) required data fields; (2) operational considerations; and (3) support for automation.  Data fields suggested include “supplier name,” “component name,” and “cryptograph hash of the component,” among others.  Operational considerations include a set of operational and business decisions and actions that establish the practice of requesting, generating, sharing, and consuming SBOMs, including “frequency,” “depth,” and “delivery.”  Automation support relates to whether the SBOM can be automatically generated and is machine-readable, which is “[a] key element for SBOM to scale across the software ecosystem.”

Over 86 written comments were submitted in response to NTIA’s request by the June 17, 2021 deadline for such comments.

Other Upcoming EO Deadlines.  The EO imposes other deadlines in June 2021 that may have been met, but for which there is no public access to the results.  These include –

  • Section 2(g)(i) of the EO requires the Department of Homeland Security (DHS), in consultation with the Department of Defense (DoD), the Attorney General, and OMB, to recommend to the FAR Council contract language regarding the reporting of cyber incidents. The EO requires such contract language to identify (1) the nature of the cyber incidents that require reporting; (2) the types of information that must be reported; (3) appropriate and effective protections for privacy and civil liberties; (4) the time periods within which contractors must report cyber incidents based on a graduated scale of severity (with reporting of the most severe cyber incidents not to exceed 3 days from initial detection); (5) National Security Systems (NSS) reporting requirements; and (6) the types of contractors and associated service providers to be covered by the proposed contract language.  We have not yet been able to confirm whether DHS submitted any recommended contract language to the FAR Council or whether, if it did, what such language says.
  • Section 7(c) of the EO requires DHS to provide OMB with recommendations on options for implementing an Endpoint Detection Response initiative to support proactive detection of cyber incidents. A senior Biden Administration official publicly confirmed that DHS had provided such recommendations to OMB, but declined to state what those recommendations are.
  • Section 7(g) of the EO requires NSA to recommend to DOD, ODNI, and the Committee on NSS by June 26, 2021, appropriate actions for improving detection of cyber incidents affecting NSS. Whether those recommendations have been issued has not been publicly disclosed.
Tags: Cyber EO, Cybersecurity, Executive Order 14028, Software, Supply Chain
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Susan B. Cassidy Susan B. Cassidy

Susan is co-chair of the firm’s Aerospace and Defense Industry Group and is a partner in the firm’s Government Contracts and Cybersecurity Practice Groups. She previously served as in-house counsel for two major defense contractors and advises a broad range of government contractors…

Susan is co-chair of the firm’s Aerospace and Defense Industry Group and is a partner in the firm’s Government Contracts and Cybersecurity Practice Groups. She previously served as in-house counsel for two major defense contractors and advises a broad range of government contractors on compliance with FAR and DFARS requirements, with a special expertise in supply chain and cybersecurity requirements. She has an active investigations practice and advises contractors when faced with cyber incidents involving government information. Susan relies on her expertise and experience with the Defense Department and the Intelligence Community to help her clients navigate the complex regulatory intersection of cybersecurity, national security, and government contracts. She is Chambers rated in both Government Contracts and Government Contracts Cybersecurity. In 2023, Chambers USA quoted sources stating that “Susan’s in-house experience coupled with her deep understanding of the regulatory requirements is the perfect balance to navigate legal and commercial matters.”

Her clients range from new entrants into the federal procurement market to well established defense contractors and she provides compliance advices across a broad spectrum of procurement issues. Susan consistently remains at the forefront of legislative and regulatory changes in the procurement area, and in 2018, the National Law Review selected her as a “Go-to Thought Leader” on the topic of Cybersecurity for Government Contractors.

In her work with global, national, and start-up contractors, Susan advises companies on all aspects of government supply chain issues including:

  • Government cybersecurity requirements, including the Cybersecurity Maturity Model Certification (CMMC), DFARS 7012, and NIST SP 800-171 requirements,
  • Evolving sourcing issues such as Section 889, counterfeit part requirements, Section 5949 and limitations on sourcing from China
  • Federal Acquisition Security Council (FASC) regulations and product exclusions,
  • Controlled unclassified information (CUI) obligations, and
  • M&A government cybersecurity due diligence.

Susan has an active internal investigations practice that assists clients when allegations of non-compliance arise with procurement requirements, such as in the following areas:

  • Procurement fraud and FAR mandatory disclosure requirements,
  • Cyber incidents and data spills involving sensitive government information,
  • Allegations of violations of national security requirements, and
  • Compliance with MIL-SPEC requirements, the Qualified Products List, and other sourcing obligations.

In addition to her counseling and investigatory practice, Susan has considerable litigation experience and has represented clients in bid protests, prime-subcontractor disputes, Administrative Procedure Act cases, and product liability litigation before federal courts, state courts, and administrative agencies.

Susan is a former Public Contract Law Procurement Division Co-Chair, former Co-Chair and current Vice-Chair of the ABA PCL Cybersecurity, Privacy and Emerging Technology Committee.

Prior to joining Covington, Susan served as in-house senior counsel at Northrop Grumman Corporation and Motorola Incorporated.

Read more about Susan B. CassidyEmail
Show more Show less
Photo of Robert Huffman Robert Huffman

Bob Huffman counsels government contractors on emerging technology issues, including artificial intelligence (AI), cybersecurity, and software supply chain security, that are currently affecting federal and state procurement. His areas of expertise include the Department of Defense (DOD) and other agency acquisition regulations governing…

Bob Huffman counsels government contractors on emerging technology issues, including artificial intelligence (AI), cybersecurity, and software supply chain security, that are currently affecting federal and state procurement. His areas of expertise include the Department of Defense (DOD) and other agency acquisition regulations governing information security and the reporting of cyber incidents, the proposed Cybersecurity Maturity Model Certification (CMMC) program, the requirements for secure software development self-attestations and bills of materials (SBOMs) emanating from the May 2021 Executive Order on Cybersecurity, and the various requirements for responsible AI procurement, safety, and testing currently being implemented under the October 2023 AI Executive Order. 

Bob also represents contractors in False Claims Act (FCA) litigation and investigations involving cybersecurity and other technology compliance issues, as well more traditional government contracting costs, quality, and regulatory compliance issues. These investigations include significant parallel civil/criminal proceedings growing out of the Department of Justice’s Cyber Fraud Initiative. They also include investigations resulting from False Claims Act qui tam lawsuits and other enforcement proceedings. Bob has represented clients in over a dozen FCA qui tam suits.

Bob also regularly counsels clients on government contracting supply chain compliance issues, including those arising under the Buy American Act/Trade Agreements Act and Section 889 of the FY2019 National Defense Authorization Act. In addition, Bob advises government contractors on rules relating to IP, including government patent rights, technical data rights, rights in computer software, and the rules applicable to IP in the acquisition of commercial products, services, and software. He focuses this aspect of his practice on the overlap of these traditional government contracts IP rules with the IP issues associated with the acquisition of AI services and the data needed to train the large learning models on which those services are based. 

Bob writes extensively in the areas of procurement-related AI, cybersecurity, software security, and supply chain regulation. He also teaches a course at Georgetown Law School that focuses on the technology, supply chain, and national security issues associated with energy and climate change.

Read more about Robert HuffmanEmail
Show more Show less
Photo of Ryan Burnette Ryan Burnette

Ryan Burnette is a government contracts and technology-focused lawyer that advises defense and civilian contractors on federal contracting compliance and on civil and internal investigations that stem from these obligations. Ryan has particular experience with clients that hold defense and intelligence community contracts…

Ryan Burnette is a government contracts and technology-focused lawyer that advises defense and civilian contractors on federal contracting compliance and on civil and internal investigations that stem from these obligations. Ryan has particular experience with clients that hold defense and intelligence community contracts and subcontracts, and has recognized expertise in national security related matters, including those matters that relate to federal cybersecurity and supply chain security. Ryan also advises on FAR and DFARS compliance, public policy matters, agency disputes, and government cost accounting.  He speaks and writes regularly on government contracts and cybersecurity topics, drawing significantly on his prior experience in government to provide insight on the practical implications of regulations.

Ryan is especially experienced with:

  • Government cybersecurity standards, including the Federal Risk and Authorization Management Program (FedRAMP); Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 and 252.204-7020; National Institute of Standards and Technology (NIST) publications, such as NIST SP 800-171; software and artificial intelligence security, attestations, and bill of materials requirements; and the Cybersecurity Maturity Model Certification (CMMC) program.
  • Supply chain requirements, including Section 889 of the FY19 National Defense Authorization Act; restrictions on covered semiconductors and printed circuit boards; Information and Communications Technology and Services (ICTS) restrictions; and matters relating to the Federal Acquisition Security Council (FASC).
  • Information handling, marking, and dissemination requirements, including those relating to Covered Defense Information (CDI) and Controlled Unclassified Information (CUI).
  • Federal Cost Accounting Standards and FAR Part 31 allocation and reimbursement requirements.

Prior to joining Covington, Ryan served in the Office of Federal Procurement Policy in the Executive Office of the President, where he developed and implemented government-wide contracting regulations and administrative actions affecting more than $400 billion dollars’ worth of goods and services each year. While in government, Ryan worked on several contracting-related Executive Orders, and worked with White House and agency officials on regulatory and policy matters affecting contractor disclosure and agency responsibility determinations, labor and employment issues, IT contracting, commercial item acquisitions, performance contracting, GSA Schedules and interagency acquisitions, competition requirements, and suspension and debarment, among others.

Additionally, in the wake of significant incidents affecting the program, Ryan was selected to serve on a core team that led reform of security processes affecting federal background investigations for cleared employees and contractors. These efforts resulted in the establishment of a new federal bureau to conduct and manage background investigations.

Read more about Ryan BurnetteEmail
Show more Show less