Accession Number:

ADA495389

Title:

Software Assurance in Acquisition: Mitigating Risks to the Enterprise. A Reference Guide for Security-Enhanced Software Acquisition and Outsourcing

Descriptive Note:

Monograph

Corporate Author:

INFORMATION RESOURCES MANAGEMENT COLL WASHINGTON DC

Personal Author(s):

• Polydys, Mary L.
• Wisseman, Stan

Report Date:

2009-02-01

Pagination or Media Count:

133.0

Abstract:

Software vulnerabilities, malicious code, and software that does not function as promised pose a substantial risk to the Nations software-intensive critical infrastructure that provides essential information and services to citizens. Minimizing these risks is the function of software assurance SwA. Software assurance is the level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its life cycle, and that it functions in the intended manner. SwA is a key element of national security and homeland security. Software vulnerabilities jeopardize intellectual property, consumer trust, business operations and services, and a broad spectrum of critical infrastructure. To ensure the integrity of business operations and key assets within critical infrastructure, software must be reliable and secure. The responsibility for SwA must be shared not only by software suppliers in the supply chain but also by the acquirer in the supply chain who purchases the software. There is a concern that acquirers are not aware of this responsibility and are inadequately prepared to support SwA in the acquisition process. This guide provides information on incorporating SwA throughout the acquisition process from the acquisition planning phase to contracting, monitoring and acceptance, and follow-on phases. For each phase, the material covers SwA concepts, recommended strategies, and acquisition management tips. The guide also includes recommended request for proposal andor contract language and due diligence questionnaires that may be tailored by acquisition officials to facilitate the contract evaluation process.

Descriptors:

• *COMPUTER PROGRAMS
• *PROCUREMENT
• *ELECTRONIC SECURITY
• RISK MANAGEMENT
• MANUALS
• VULNERABILITY
• CONTRACT ADMINISTRATION

Subject Categories:

• Computer Systems Management and Standards
• Administration and Management

Distribution Statement:

APPROVED FOR PUBLIC RELEASE