§18933 Software security and authentication

Summary

The Director must give severity scores to vulnerabilities in open source software and make voluntary guidance to help repository maintainers find and fix those problems. The Director must also do research and testing to make AI-based cybersecurity better, including making training data for AI defenses and testing different network designs to see what improves security. The Director must make sure all Institute software is digitally signed and kept up so people can confirm it is real and unchanged when they install or run it. If funding is available, the Director must help train Federal Inspectors General and their staff who do the annual security review required under section 3555 of title 44. The Director must work with industry, schools, and other agencies to create software security outcomes and practices for the full software lifecycle and promote their voluntary use.