Cybersecurity Coalition raises questions over provenance, SBOM in response to CISA self-attestation form

The Cybersecurity Coalition is seeking clarity on how CISA plans to address provenance as part of the self-attestation process for secure software, and pushes back against the inclusion of Software Bill of Materials in the final common form that contractors will need to submit to do business with the government.

CISA released a draft common form in April for software producers to self-attest their compliance with the NIST Secure Software Development Framework. The agency set up a 60-day public...