SecureChain for Open Source Software

Key Takeaways A transitive dependency is a package you get because something you depend on needs it. One npm package can drag in hundreds of transitive dependencies, each able to...

Key Takeaways The CRA, FedRAMP, NIS 2, and PCI DSS ask the same two questions of your open source components: what you ship, and what happens when a vulnerability is...

Key Takeaways Under FedRAMP’s 2026 rules, recommended remediation timeframes run from 12 hours to 192 days, counted from the provider’s evaluation of the vulnerability. New applicants must follow FedRAMP’s 2026...

Key Takeaways NIS2 Article 21 makes supply chain security a minimum measure and has entities weigh each direct supplier’s vulnerabilities. ENISA, the EU cybersecurity agency, says in its non-binding hospital...

Key Takeaways Without a third-party assessment, the CEO or an employee designee authorized to bind the corporation signs the form. The signer attests, to the best of their knowledge, that...

Key Takeaways The Federal Risk and Authorization Management Program (FedRAMP) Revision 5 (Rev5) playbook requires providers to upload an updated plan of action and milestones monthly. FedRAMP’s Consolidated Rules for...

Key Takeaways The NIST (National Institute of Standards and Technology) Secure Software Development Framework (SSDF) asks you to keep verifying third-party components, including open source ones, against your own requirements....

Key Takeaways A Vulnerability Exploitability eXchange (VEX) statement gives one status for one vulnerability across one or more products. A VEX statement is its author’s claim, so an auditor checks...

Key Takeaways DORA’s register of information lists contracts for technology services provided on an ongoing basis, so a library you download with no contract usually isn’t in it. Binding technical...

Key Takeaways Since July 13, 2026, defense solicitations may require only Level 1 or Level 2 self-assessments, while Phase 2 remains suspended. None of the 110 Level 2 requirements mention...

Key Takeaways Under the Cyber Resilience Act, you have to handle vulnerabilities in your product, including those in its dependencies, for at least five years unless it is expected to...