Nextgov, September 14, 2022

By Chris Riotta 

Technology trade groups are aligning against a proposal in the House-passed defense policy bill that would require software vendors to attest to the government that their products are free of known defects and to include a bill of materials describing their code.

The groups – the Alliance for Digital Innovation, BSA | The Software Alliance, the Cybersecurity Coalition and the Information Technology Industry Association – say that the legislation leapfrogs ongoing administrative efforts to establish software bills of materials (SBOMs) as part of the federal acquisition process. Those efforts, the groups say, are still in their developing stages and there isn't a consistent approach to SBOMs – essentially ingredient lists that tell what proprietary and open source components are included in software application.

"Ultimately, SBOMs will not achieve the desired utility for agencies at this point because of a lack of standardization," the groups said in a Sept. 14 letter to the heads of multiple committees of Congress. "This highlights the need for additional work to include guidance on the structure and construction of an SBOM and standardization of the processes for SBOM dissemination, ingestion, and use."

Read More >>

Original Posting: https://www.nextgov.com/cxo-briefing/2022/09/industry-cautions-software-security-regs-defense-bill/377148/