Fortress Information Security Bolsters Software Attestation Capabilities Ahead of Expected 2024 Deadline for Federal Agencies

North American Energy Software Assurance Database (NAESAD) To Support Compliance with Upcoming Federal Software Security Requirements

ORLANDO, Fla., Oct. 23, 2023 /PRNewswire/ -- Today, Fortress Information Security released new software attestation capabilities to enable government agencies and government contractors to meet stringent software security mandates expected in early 2024. With improved capabilities for Software Supply Chain Security (SSCS), Fortress' newest offering helps public sector supply chains become more secure and resilient.

New federal mandates require all federal vendors and contractors to complete an attestation form for software products they sell to federal agencies. Attestations assure that software used by government agencies is securely developed according to the National Institute of Science and Technology's (NIST) Secure Software Development Framework (SSDF). 

"Once OMB approves the attestation form, federal agencies will have to move very quickly to meet the requirements in the President's Cybersecurity Strategy," said Ty Short, Vice President of Product. "Contractors will need to be ready to hit the ground running. By providing users with the most comprehensive, secure software development testing record, our attestation product reduces regulatory burdens for government agencies and contractors. Additionally, users will see cost savings thanks to the ability to collaborate on attestations, certifications, and Plan of Action & Milestones."

The push for attestations is a part of the President's Cybersecurity Strategy and a result of the SolarWinds supply chain hack of 2021, which many believe was launched by the Russian Intelligence Service. New research by Fortress shows that developers in Russia and China are building components frequently found in repositories like GitHub and in software commonly used by America's electric companies.

Key features and capabilities of the Fortress attestation offering include:

• Software version tracking to initiate attestation updates as new major software versions are released
• Single interface to track compliance, remediation efforts, and exception management
• Designation of critical software
• Vendor outreach to ensure attestation response
• Unification of existing tools with Fortress Platform API and connectors

Fortress' outreach to suppliers for Secure Software Development (SSD) attestations is executed through the North American Energy Software Assurance Database (NAESAD). NAESAD enables the sharing of attestations at scale with all federal customers, simplifying the response process and speeding up response times.

"Federal agencies can create a more integrated, secure, and efficient software development ecosystem that aligns with their strategic goals," said Short. "Fortress guides our clients through product discovery, attestation collection, triaging non-compliance, escalations, and replacement tracking, as well as continuous monitoring for new software versions to ensure attestations are up to date and accurate. This solution is absolutely critical to helping federal agencies, vendors, and contractors meet new attestation requirements."

About Fortress

Securing critical supply chains and cyber assets from evolving threats.

Fortress. Absolutely Critical.
https://www.fortressinfosec.com/secure-software-development-attestation-management

About NAESAD

North American Energy Software Assurance Database (NAESAD): An industry-wide collaborative database to create and share Software Bills of Materials (SBOM) in products used by utilities across North America. NAESAD is led by several investor-owned utilities (including AEP, Southern, Xcel, and NiSource) and managed by Fortress Information Security to create a comprehensive SBOM library for common vendors and suppliers.

Contact: Adam Benson, [email protected], 202.999.9104

SOURCE Fortress Information Security