42 U.S.C. § 18933 — Software security and authentication

(a) Vulnerabilities in open source software. The Director^* must assign severity ratings to known vulnerabilities in open source software, and produce voluntary guidance to help entities that maintain open source software repositories find and fix them.

(b) Artificial intelligence-enabled defenses. The Director must research and test ways to make AI-enabled cybersecurity more effective, including by generating optimized data sets to train AI defense systems, and by evaluating how different network designs strengthen network security.

(c) Authentication of Institute^* software. The Director must make sure all software the Institute releases is digitally signed and kept up to date, so stakeholders can verify it's genuine and hasn't been tampered with when they install and run it.

(d) Assistance to Inspectors General. If funding is available, the Director must give technical help to improve training for individual federal agencies' Inspectors General and staff, who must perform the annual independent review of each agency's information security program required under section 3555 of title 44.

(e) Software supply chain security practices^*.
(1) The Director, working with industry, academia, and other agencies as appropriate, must develop security outcomes and practices, including security controls, control enhancements, supplemental guidance, or other supporting information, to help software developers and operators identify, assess, and manage cybersecurity risks across a software product's full lifecycle.
(2) The Director must reach out to and coordinate with federal agencies, relevant industry stakeholders, and standards organizations, as appropriate, to encourage voluntary adoption of these software lifecycle security practices by federal agencies and industry.