CISA issues recommendations to federal agencies on open-source software security | CyberScoop<\/title> <meta name=\"description\" content=\"CISA issued new security guidance for federal agencies on managing open-source software risks, covering patching, asset tracking, and open-weight AI models\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/cisa-open-source-software-security-guidance\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"CISA issues recommendations to federal agencies on open-source software security\"> <meta property=\"og:description\" content=\"CISA issued new security guidance for federal agencies on managing open-source software risks, covering patching, asset tracking, and open-weight AI models\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/cisa-open-source-software-security-guidance\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2026-07-30T18:24:17+00:00\"> <meta property=\"article:modified_time\" content=\"2026-07-30T18:24:19+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1920\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Tim Starks\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@timstarks\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1784312972g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1785274254g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1782867887g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=9519dd464d894b805a10\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/90036\"><meta name=\"generator\" content=\"WordPress 6.8.6\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=90036\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fcisa-open-source-software-security-guidance%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fcisa-open-source-software-security-guidance%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-90036 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/cisa-open-source-software-security-guidance\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"26.45486935867\">\n<div class=\"single-article__header-content\" readability=\"36.395778364116\">\n<p> One expert said they were pleased by the guidance, which touches on open-weight AI models, patching and more. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/90036\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"640\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security.jpg?resize=640%2C640&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=150,150 150w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=300,300 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=768,768 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=1024,1024 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=1536,1536 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=600,600 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=168,168 168w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=337,337 337w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=675,675 675w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-2.jpg?resize=843,843 843w\" sizes=\"(max-width: 675px) 100vw, 675px\"><figcaption> Aliaksei Brouka; iStock\/Getty Images Plus <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"40.78458881934\"><body readability=\"84.817658349328\"><\/p>\n<p>The Cybersecurity and Infrastructure Security Agency published a guidebook for federal agencies Thursday to aid them on managing security risks with open-source software, touching on topics like patching and open-source AI models.<\/p>\n<p>An executive order <a href=\"https:\/\/cyberscoop.com\/biden-cyber-executive-order-gets-mostly-plaudits-but-its-fate-is-uncertain\/\">President Joe Biden signed<\/a> and that <a href=\"https:\/\/cyberscoop.com\/trump-administration-cybersecurity-executive-orders-policy-changes-2025\/\">President Donald Trump amended<\/a> ordered CISA and other agencies to issue open-source security recommendations to federal agencies. But the guidance is also timely, given <a href=\"https:\/\/cyberscoop.com\/open-source-software-security-crisis\/\">a recent slew of attacks<\/a> on open-source software (OSS).<\/p>\n<p>\u201cAs part of our statutory mission, CISA remains laser-focused on enhancing the nation\u2019s cybersecurity by collaborating with government, industry and the open-source community to understand and securely use OSS,\u201d said Chris Butera, acting executive assistant director for cybersecurity. \u201cCISA encourages federal civilian agencies to review this guide and implement the principles and practices to improve risk management, better execute their mission, and better serve the public.\u201d <\/p>\n<p>The document, <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2026-07\/open-source-software-security-principles.pdf\">\u201cOpen Source Software: Security Principles and Practices,\u201d<\/a> touts the advantages of open-source software \u2014 which anyone can use, modify and share \u2014 as offering benefits in efficiency, cost, security transparency and more, but notes that it also has unique tradeoffs.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cAll software carries risk, and OSS is no more or less risky than other software. The key distinction is that, with OSS, agencies can directly assess code quality and security, rather than relying solely on vendor assurances,\u201d the guidance reads. \u201cOSS is increasingly intertwined with emerging technologies such as artificial intelligence. Agencies that adapt to OSS\u2019s unique characteristics will position themselves to meet future challenges and leverage new innovations.\u201d<\/p>\n<p>The guidance says that agencies need to take steps to evaluate the trustworthiness of an OSS project before approving an OSS component for use, and track OSS in their asset management repositories. It details how agencies should deal with patching, including when there\u2019s a new OSS vulnerability that doesn\u2019t have one. It offers advice on how agencies might contribute to OSS projects, produce them and secure rights for government reuse of code when contracting for custom software development. And it explains how it should approach open-weight AI models.<\/p>\n<p>\u201cAgencies should approach \u2018open source\u2019 AI systems differently from other OSS because open source licenses for AI software do not require the level of transparency needed to evaluate the trustworthiness of the software,\u201d the guidance states.<\/p>\n<p>\u00c6va Black, an open-source security expert and former OSS lead at CISA, said she applauded her former agency for the guidance, telling CyberScoop that it \u201cdemonstrates a grounded understanding of the global, diverse, and participatory nature of open source software development, and provides essential guidance for federal agencies to safely use open soure during a crucial moment.\u201d <\/p>\n<p>She singled out its recommendations on the risks of deploying unverifiable open-weight AI models on sensitive networks.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cDue to recent advances in AI, particularly in large language models capable of finding and exploiting software vulnerabilities, vulnerability management is facing a global crisis,\u201d she said. \u201cMany proprietary software vendors are using this as an opportunity to spread \u2018fear, uncertainty, and doubt\u2019 about open source in order to capture public attention, and, I presume, public money \u2014 but when used responsibly and maintained collaboratively, I believe open source software is, and will remain, the safest and most cost-effective means for building large scale public infrastructure.\u201d <\/p>\n<p>CISA has produced a bevy of security guidance and updated advisory materials this week: on the creation of <a href=\"https:\/\/www.cisa.gov\/resources-tools\/resources\/2026-minimum-elements-software-bill-materials-sbom\">software bills of materials<\/a> written in conjunction with other agencies and allied governments that won <a href=\"https:\/\/www.linkedin.com\/pulse\/minimum-just-got-bigger-cisa-friends-new-sbom-allan-friedman-phd-6jhle\/\">praise from experts<\/a>; on the <a href=\"https:\/\/www.cisa.gov\/resources-tools\/resources\/ci-fortify-advice-isolating-vital-systems\">isolation of vital operational technology<\/a> during a crisis, also written with other agencies and allied governments; and <a href=\"https:\/\/x.com\/CISAgov\/status\/2082873959284924716\">the release<\/a> of updated secure cloud configuration baselines for Google Workspace.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"author-card\" readability=\"7.7216117216117\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security-1.jpg?w=640&ssl=1\" alt=\"Tim Starks\"> <\/figure>\n<\/p><\/div>\n<div class=\"author-card__details\" readability=\"10.901098901099\">\n<h4 class=\"author-card__name\">Written by Tim Starks<\/h4>\n<p> Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: <a href=\"mailto:tim.starks@cyberscoop.com\">tim.starks@cyberscoop.com<\/a>. <\/div>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/cisa-open-source-software-security-guidance\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CISA issues recommendations to federal agencies on open-source software security<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6911,384,622,452,1599,2977,117,1073,439,290],"tags":[6914,388,627,454,1601,2979,119,1076,443,296],"class_list":["post-8883","post","type-post","status-publish","format-standard","hentry","category-aeva-black","category-artificial-intelligence-ai","category-biden-administration","category-cybersecurity-and-infrastructure-security-agency-cisa","category-executive-order","category-federal-it","category-government","category-open-source","category-policy","category-trump-administration","tag-aeva-black","tag-artificial-intelligence-ai","tag-biden-administration","tag-cybersecurity-and-infrastructure-security-agency-cisa","tag-executive-order","tag-federal-it","tag-government","tag-open-source","tag-policy","tag-trump-administration"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/aeva-black\/\" rel=\"category tag\">\u00c6va Black<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/artificial-intelligence-ai\/\" rel=\"category tag\">artificial intelligence (AI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/biden-administration\/\" rel=\"category tag\">Biden administration<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity-and-infrastructure-security-agency-cisa\/\" rel=\"category tag\">Cybersecurity and Infrastructure Security Agency (CISA)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/executive-order\/\" rel=\"category tag\">Executive order<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-it\/\" rel=\"category tag\">Federal IT<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government\/\" rel=\"category tag\">Government<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/open-source\/\" rel=\"category tag\">open source<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/policy\/\" rel=\"category tag\">Policy<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/trump-administration\/\" rel=\"category tag\">Trump administration<\/a>","tag_info":"Trump administration","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8883"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8883\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8883,"date":"2026-07-30T13:24:17","date_gmt":"2026-07-30T18:24:17","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=90036"},"modified":"2026-07-30T13:24:17","modified_gmt":"2026-07-30T18:24:17","slug":"cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2026\/07\/30\/cisa-issues-recommendations-to-federal-agencies-on-open-source-software-security\/","title":{"rendered":"CISA issues recommendations to federal agencies on open-source software security"},"content":{"rendered":"