Pentagon to establish secure software assurance program
Summary
What does it mean to secure the development pipelines?” said Rob Vietmeyer, DoD’s chief software officer, after speaking at AFCEA NOVA’s IT Innovation day. So we’re trying to find that interface.” DoD will issue requests for information (RFIs) in the coming weeks that describe its objectives and collect feedback about the security controls for software products it should consider. “We will announce the objectives for this effort, a high-level framework, and in a few months, engage with industry to establish these controls and processes to have this conversation about how we raise our posture of supply chain security,” he said. “I am directing the use of Commercial Solutions Openings and Other Transactions as the default solicitation and award approaches for acquiring capabilities under the SWP,” Hegseth wrote. “We want to make sure that we’re not looking at these processes as throw over the fence innovations, but we can build them into an integrated technology framework across the department that allows us to make sure that these are deploying in a way that meets and will continue to meet the warfighter mission need, the resilience, the security posture of the highly dynamic battle space that we’re facing right now.” Along with ensuring commercial software is secure, Vietmeyer said DoD wants to apply artificial intelligence to its own DevSecOps pipeline.