CISA plans to develop ‘central repository’ for software self-attestations, update SBOM guidance

The Cybersecurity and Infrastructure Security Agency is in the process of creating a “central repository” for software self-attestation that will help agencies keep track of what has been approved for federal use, according to an agency official.

The central repository is a requirement from the 2022 Office of Management and Budget memorandum on securing the software supply chain. The memo turned over responsibilities on Software Bill of Materials from the 2021 cyber executive order to CISA and the agency...