§18933 Software Security and Authentication

Summary

The Director must give severity ratings for bugs found in open-source software and publish voluntary guidance to help repository maintainers find and fix those bugs. The Director must also research and test AI-based cyber defenses, including making better training datasets and checking different network designs. All software released by the Institute must be digitally signed and kept updated so people can verify it is authentic and unaltered. If funding is available, the Director must offer technical help to train Inspectors General and staff who do the yearly independent checks of agency information security. The Director must work with industry, universities, and other agencies to create security goals and practices for the full software lifecycle and share this guidance so agencies and companies can adopt it voluntarily.