How to defend ARM64 cloud infrastructure from ITScape
RL has documented CVE-2026-46316, and developed two YARA rules to help detect exploits of the multi-tenant cloud vulnerability.
FedRAMP Software Supply Chain Rules
What Are FedRAMP Software Supply Chain Rules?
FedRAMP (Federal Risk and Authorization Management Program) software supply chain rules refer to the mandatory security practices and compliance requirements that cloud service providers (CSPs) must follow to ensure the integrity and trustworthiness of their software, dependencies, and delivery pipelines when selling to the U.S. federal government.
These rules are derived from multiple federal directives, including Executive Order 14028, NIST guidance (e.g., SSDF, 800-218), and CISA’s supply chain security framework.
Why FedRAMP rules are important
The U.S. government is a high-value target for cyber attackers. FedRAMP’s rules help mitigate the risk of compromised software entering federal environments by enforcing:
- Provenance verification
- Secure development practices
- Continuous monitoring
- Software artifact validation
By following these rules, CSPs and their partners enhance both federal and commercial trust in their software supply chain practices.
How does FedRAMP work?
FedRAMP integrates software supply chain security into its authorization process. Key expectations include:
- SBOM Requirement: All cloud services must produce and maintain a Software Bill of Materials for components and dependencies.
- Secure Development Attestations: Providers must document adherence to the NIST Secure Software Development Framework (SSDF).
- Artifact Integrity Verification: Code must be signed and validated before deployment.
- CI/CD Security Controls: Build environments must implement access controls, logging, and tamper protection.
- Security workflows must ingest threat data to assess risks associated with third-party or open-source components.
