The CISA Guidelines for Software Supply Chains are a set of best practices, risk management principles, and policy recommendations published by the Cybersecurity and Infrastructure Security Agency (CISA) to help organizations secure their software development lifecycle (SDLC) and defend against supply chain threats.
These guidelines aim to ensure the integrity, transparency, and resilience of software components, whether developed internally or sourced from third parties.
The growing sophistication of supply chain attacks, such as SolarWinds and Log4Shell, has exposed vulnerabilities in the development, distribution, and consumption of software. CISA’s guidelines provide a foundation for securing the software ecosystem across public and private sectors.
Following these practices helps organizations:
The guidelines are organized into three roles:
CISA also encourages alignment with:
The guidelines provide checklists, maturity models, and tooling recommendations for implementing layered security in CI/CD pipelines and procurement processes.
Topic | Focus Area | Key Differences |
|---|---|---|
NIST SSDF | Development practices | CISA builds on NIST and adds procurement, supplier, and acquirer roles |
EO 14028 | U.S. federal policy directive | CISA operationalizes EO 14028 for real-world security implementation |
SLSA Framework | Build pipeline assurance | CISA includes SLSA as one element of its broader guidance |
Integrated security in AI assistants could help to catch code flaws — but they are only one layer in a comprehensive AppSec strategy.
Learn More about AI coding tools gain security — but the controls do not cut it
Scott Culp’s formulation still holds true — though some additions are needed that account for software supply chain security.
Learn More about ‘The Immutable Laws of Security’ at 25: 5 corollaries for a new era
Software procurement is risky business. Learn why outdated tooling doesn’t cut it — and how modern technologies can provide much-needed transparency.
Learn More about Why complex binary analysis is an essential tool for TPSRM