CISA publishes federal guide for secure open source software and AI model use

CISA has published new federal guidance for managing open source software, putting package selection, contribution practices, vulnerability handling and open source AI evaluation into a single security playbook for agencies.

The July 30 publication, Open Source Software: Security Principles and Practices, frames OSS as a normal part of government technology rather than an exception. CISA says open source components are embedded across modern systems, including business software and critical infrastructure, and argues that agencies need repeatable approval and review processes so staff can use useful tools without losing visibility into supply-chain risk.

What the guidance covers

The document introduces risk-management recommendations across the OSS lifecycle: choosing projects, understanding dependencies, contributing to external communities, publishing government-developed code and responding when vulnerabilities appear. CISA specifically points agencies toward patching discipline, software bill of materials use, secure development practices and a trust assessment model it calls the C4 Framework.

• Agencies are urged to review and approve OSS in a way that supports mission needs while documenting risk tolerance.
• The guidance ties software inventory work to SBOMs, making dependencies easier to inspect when new flaws are disclosed.
• For projects agencies publish or contribute to, CISA emphasizes responsible participation and sustainable maintenance.

The AI section is especially notable because it warns agencies not to treat a model as open source for risk-management purposes unless they have enough transparency into the relevant components, including training data. CISA’s rationale is practical: without access and visibility, agencies cannot fully study a system, analyze it for vulnerabilities or remediate discovered risks.

The new resource follows a busy week for federal software-supply-chain work. CISA and partners released updated Software Bill of Materials material on July 29, and the agency says the OSS guide aligns with recent executive orders directing federal networks to better manage OSS use. CISA also cites incidents such as Log4Shell and the xz utils backdoor attempt as reminders that hidden dependencies can turn widely reused code into a government-wide exposure.

For technology teams, the immediate takeaway is that open source is being treated as critical infrastructure plumbing. The guide does not tell agencies to avoid OSS; it tells them to inventory it, judge project trustworthiness, patch it quickly and understand the difference between genuinely inspectable software and products that only carry an open label.

Sources

• www.cisa.gov
• www.cisa.gov

Cover photo by Markus Spiske on Pexels, used under the Pexels License.