- CISA’s new guidance outlines practices for agencies to adopt, assess and contribute to open source software securely
- The resource addresses risks tied to software dependencies, including vulnerabilities exposed by incidents such as Log4Shell
- Agencies are encouraged to establish review and approval processes before deploying open source tools
The Cybersecurity and Infrastructure Security Agency has released new guidance to help federal agencies securely use, assess and contribute to open source software.
What Is the CISA Open Source Software Resource?
CISA said Thursday the Open Source Software: Security Principles and Practices resource provides federal agencies with considerations and best practices for adopting and vetting open source tools, participating in OSS projects, developing open source products and evaluating open source AI models.
The agency said OSS is widely used throughout the federal government and critical infrastructure sectors as a key part of the software supply chain, helping agencies support mission needs while managing software-related risks. The guidance addresses the need for agencies to understand dependencies within software components, citing vulnerabilities such as Log4Shell and xz utils as examples of OSS-related risks.
CISA’s guidance highlights the growing need for agencies to strengthen cybersecurity practices as they adopt emerging technologies and manage software risks. Hear from DHS leaders and industry experts on evolving cyber priorities at the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10. Book your seat today.
What Does the CISA Guide Recommend?
The CISA guide recommends that agencies have a formal review and approval process in place before adopting open source tools, so that security risks are managed from the outset. The resource lays out patching principles, a software trustworthiness and risk assessment method, and practices for secure, responsible and sustainable OSS project engagement.
Two executive orders inform the guidance: Executive Order 14144, which points to the advantages OSS offers federal agencies, and Executive Order 14306, which calls on federal networks to tighten security and manage OSS use more effectively. The guidance follows earlier cybersecurity policy changes under EO 14144, which established requirements for secure software development practices and CISA oversight responsibilities.
CISA advises that agencies should not classify an AI system as open source for risk-management purposes unless they can first verify transparency into its key components, including its training data. The agency noted that this kind of transparency and access lets organizations analyze software components, identify vulnerabilities and mitigate security risks.
