Topic · ssdf

NIST SP 800-218 (SSDF)

Secure Software Development Framework — federal procurement attestations and supplier requirements driven by EO 14028.

RSS feed ↗

trade-press
Sandworm_Mode targets AI coding assistants and CI/CD pipelines
The compliance problem is not AI novelty; it is secret sprawl moving faster than review, logging and provenance can explain.
CyberScoop reports that CrowdStrike reviewed Sandworm_Mode, a self-propagating worm found by Socket in February, that targets AI coding assistants, LLM API keys, cloud credentials and CI/CD systems. Developers, DevOps teams and software suppliers face the operational exposure. The ugly part is familiar: the malware hides inside normal automated dependency activity, and CrowdStrike has not pinned down its operator, intent or current activity.
WED
standards
CIS, SAFECode update Secure by Design for AI
The available source describes a guide update, not a disclosed mandate, deadline or required AI tool.
CIS and SAFECode updated Secure by Design: A Developer’s Guide to Building Safer Software to address AI’s role in software security. The change affects readers who track secure software development guidance, including independent software vendors, primes and contractors. The source does not disclose specific tool requirements, implementation timelines or procurement consequences.
JUL 13
trade-press
AI-generated code forces CISOs to measure risk velocity
The useful warning is not that AI writes bad code; it is that AppSec queues were never sized for machine-speed change.
A CyberScoop op-ed argues CISOs should treat AI-generated code as a high-risk input, with automated testing, dependency checks, fast remediation and policy gates before production. The piece says the relevant metric is “risk velocity,” citing familiar failure modes such as weak validation, hard-coded secrets, vulnerable dependencies and package hallucinations. The claim is governance, not magic: faster code creation makes old review bottlenecks worse.
JUL 13
trade-press
Zabierek pushes state software liability for secure-by-design rules
The federal strategy keeps naming manufacturers, but the legal pressure may arrive first from state product and privacy law.
Former CISA secure-by-design co-lead Lauren Zabierek told Inside Cybersecurity that states should explore software liability rules, using privacy and product-liability frameworks to push manufacturers toward secure-by-default development. The argument lands on state procurement offices, legislatures and software vendors, especially around critical infrastructure. Her uncomfortable point is capacity: the Trump resiliency order puts more security and resilience on states she says do not yet have the resources.
JUL 9
trade-press
Former CISA official Cable presses DoD on secure-by-design AI coding guardrails
CISA’s old point follows the code generator: security becomes useful only when it constrains the first draft.
Former CISA senior official Jack Cable, now co-founder of Corridor Security, told Inside Cybersecurity that DoD should apply secure by design principles as it scales AI-assisted coding, including its Feb. 19 call for AI-enabled coding capabilities. The advice has a business model attached. It still lands cleanly on developers, acquisition teams and reviewers who must guide AI agents before generated code reaches defense software pipelines.
JUL 6
trade-press
NIST NCCoE advances Cyber AI Profile, agent identity work
NIST is treating AI as plumbing for cybersecurity programs, which means old control maps will need uncomfortable new seams.
Federal News Network reports that NIST’s National Cybersecurity Center of Excellence is moving six AI-cyber projects, including a summer revision of the Cyber AI Profile and agent identity work that drew comments from more than 600 organizations. Primes, contractors, managed service providers and C3PAOs should read this as early architecture guidance, not certification text. The unresolved question is whether NIST will map existing Cybersecurity Framework, DevSecOps and supply-chain practices tightly enough to change compliance evidence.
JUN 30
regulator
CISA turns Secure by Design toward EdTech pledges
The whitepaper still reads as guidance, but CISA is teaching buyers how to make voluntary baselines feel expensive to ignore.
CISA released the second iteration of its Secure by Design whitepaper, expanding co-endorsement to 18 U.S. and international partners and adding more detail on evidence artifacts. It also launched a K-12 EdTech pledge asking software manufacturers to commit to secure development practices, publish a roadmap, and stop charging extra for basic security features. Primes and ISVs should read this less as a pamphlet and more as early procurement pressure.
JUN 29
regulator
CISA sets IT SSGs for secure software development
CISA can call them voluntary while critical-infrastructure buyers convert the goals into supplier evidence requests.
The Cybersecurity and Infrastructure Security Agency (CISA) released voluntary information technology (IT) Sector Specific Goals (SSGs) on Jan. 7 for secure development, product design and software supply chain risk management. They reach primes, subcontractors, independent software vendors and contractors serving critical infrastructure, with practices covering development-environment separation, trust-relationship monitoring, phishing-resistant multi-factor authentication, secrets management and supply chain risk management. The next 18 months are a procurement story: customer contracts can mandate what CISA frames as voluntary.
JUN 29
trade-press
GAO urges CISA to resolve OMB-NIST SBOM conflict
Federal procurement moved before the compliance mechanics existed, leaving vendors to reconcile static paperwork with operational vulnerability data.
Inside Cybersecurity reports that the Government Accountability Office found 17 of 24 surveyed agencies saw a conflict between Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) Software Bill of Materials (SBOM) guidance. OMB treated SBOMs as optional static artifacts; NIST treated them as compliance data for vulnerability management. Contractors, primes, subs and Certified Third-Party Assessment Organizations (C3PAOs) get the result: parallel agency collection workflows unless the Cybersecurity and Infrastructure Security Agency (CISA) gives agencies a common implementation model.
JUN 29
trade-press
Open-source attacks expose supply-chain accountability gaps
The hard part is assigning responsibility for code everybody uses, nobody owns, and procurement still treats as somebody else’s evidence problem.
CyberScoop reports that open-source software attacks are rising as experts question how much government can do without heavier vendor accountability. Former CISA open-source security staffers described years of underinvestment and setbacks under President Donald Trump, while Project Glasswing said it found 6,202 high- or critical-severity vulnerabilities across more than 1,000 projects. Federal buyers, software suppliers and maintainers all feel the risk; only one of those groups usually gets a contract clause.
JUN 24
vendor
EO 14409 sets 2030 contractor deadline for post-quantum FIPS
The advisory phase is over, and OMB now has to turn crypto inventory work into procurement evidence.
Executive Order 14409, signed June 22, 2026, gives agencies until Dec. 31, 2030, to move their most sensitive systems to post-quantum cryptography for encryption and until Dec. 31, 2031, for authentication. Federal contractors must meet post-quantum Federal Information Processing Standards by the end of 2030 or risk procurement ineligibility. The hard part is the evidence: the Office of Management and Budget still has to say how compliance gets verified.
JUN 23
trade-press
TeamPCP compromises more than 1,000 open-source packages
For federal suppliers, Secure Software Development Framework evidence starts to matter when engineering can prove what automated build systems consumed and published.
CyberScoop reports that TeamPCP has compromised and injected malicious code into more than 1,000 open-source packages in under four months, abusing continuous integration and continuous delivery (CI/CD) automation and artificial intelligence-assisted dependency habits. Developers, maintainers and software buyers that ingest packages at speed are affected. For Secure Software Development Framework (SSDF) programs, the gap is verification: a familiar package name does not prove a clean build path.
JUN 18
trade-press
Claude Code’s 30-plus patches expose AI agent update gap
For regulated teams, the risk is the week between a quiet fix and the next version they are allowed to run.
CyberScoop reports that Backslash Security reviewed Claude Code update logs and traced more than 30 security-relevant patches between April and early June 2026, including data poisoning, prompt injection, arbitrary code execution, OAuth leakage and a backslash bypass for destructive commands. Anthropic patched the issues, but did not separately publicize them. Teams that freeze AI coding-agent versions for vetting, air-gapped use or stability inherit the gap that auto-update users largely avoid.
JUN 16
vendor
Microsoft flags Claude Code Action secret-exposure flaw
Agentic CI/CD turns issue comments into an input boundary, and old secret-scrubbing assumptions do not cover that model.
Microsoft Threat Intelligence says Anthropic’s Claude Code GitHub Action could expose CI/CD workflow secrets when agents processed untrusted GitHub issues, pull request text, or comments. The gap was in the Read tool, which Microsoft says could access /proc/self/environ and read ANTHROPIC_API_KEY and possibly other runner credentials. Anthropic mitigated it in Claude Code 2.1.128 by blocking sensitive /proc files; teams using AI-assisted GitHub workflows need to separate untrusted content from secrets and tool access.
JUN 5
trade-press
House NDAA amendment targets CMMC cost burden
Congress is no longer just watching CMMC rollout mechanics; it is asking whether the market structure is pricing out small suppliers.
Inside Cybersecurity reports that House Armed Services advanced the fiscal 2027 National Defense Authorization Act, 44-12, with a Rep. Jeff Crank amendment requesting a Defense Department briefing on Cybersecurity Maturity Model Certification reforms by March 1, 2027. The amendment cites excessive regulatory burdens, small-business disadvantage, and fee transparency concerns involving the Cyber AB and CMMC Third-Party Assessment Organizations. Primes, subs, assessors, and the Cyber AB get the message: CMMC cost is now a Hill oversight target.
JUN 5