CISA Guide Helps Federal Agencies Securely and Effectively Use Open Source Software

The Cybersecurity and Infrastructure Security Agency (CISA) published *Open Source Software: Security Principles and Practices*, a guide for federal agencies on securely adopting, assessing, and contributing to open source software (OSS). The document aligns with Executive Order 14144, which promotes OSS benefits, and Executive Order 14306, which mandates improved security in federal networks. The guidance addresses risks highlighted by past exploits like log4shell and xz utils, emphasizing the need for agencies to understand software dependencies in their supply chains.

CISA recommends agencies establish processes to review and approve OSS while balancing operational needs and risk management. The guide outlines principles for patching, frameworks to evaluate trustworthiness, and best practices for secure, responsible, and sustainable OSS engagement. It also includes considerations for open source AI models, urging agencies to ensure transparency into all components, such as training data, before classifying them as OSS for risk assessment purposes.

Acting Executive Assistant Director for Cybersecurity Chris Butera emphasized CISA’s focus on enhancing national cybersecurity through collaboration with government, industry, and the open-source community. He encouraged federal agencies to adopt the guide’s principles to improve risk management, mission execution, and public service delivery. The guidance aims to standardize secure OSS practices across federal civilian agencies.

The document builds on CISA’s broader efforts to secure the software supply chain, which relies heavily on OSS across critical infrastructure sectors. By providing structured frameworks and best practices, CISA seeks to help agencies mitigate vulnerabilities while leveraging OSS’s efficiency and flexibility. For additional details, agencies can visit CISA’s Open Source Security page on CISA.gov.