Tag

#cisa

Tagged “cisa”

2 articles

CISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship

The CISA report 'Open Source Software: Security Principles and Practices' argues open source can be as safe as proprietary software, provided consumers score each component against a C4 framework (Codebase, Community, Conduct, Configuration). For any CI/CD team selling into regulated buyers, that scoreboard is going to arrive as an audit checklist.

Aug 3, 2026 · Tomás Vega Security & supply chain

CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS

The 2026 Minimum Elements guidance from CISA replaces the 2021 NTIA baseline, adds required hash, license and generation-context fields to every SBOM, renames Supplier Name to Component Producer, and extends the floor to open-source software, AI systems and software-as-a-service. For platform teams the practical consequence is that SBOM work stops living inside the build step and starts spilling into vendor contracts and runtime re-validation.

Aug 2, 2026 · Maya Okonkwo