Software Assurance in Acquisition and Contract Language

Tracking Security Issues. It has provisions for a vendor to selfcertify
and provide a “certification package” that establishes the
security requirements, design, implementation, and test results
were properly completed and all security issues were resolved
appropriately. It offers provisions for specifying the developer is
to warrant that the software shall not contain any code that does
not support a software requirement and weakens the security of
the application, including computer viruses, worms, time bombs,
back doors, Trojan horses, Easter eggs, and all other forms of
malicious code. It offers procurement language for how security
issues will be investigated.
Sample RFP/Contract Language:
General Audience
Anyone contracting for software or outsourcing software
related services should take advantage of sample instructions
to suppliers and work statements, along with language for
acceptance criteria, security controls, secure configuration, and
certifications for originality and security.
SAMPLE INSTRUCTIONS TO POTENTIAL SUPPLIERS – The
following is generic language to include in solicitations. This
language provides instructions to potential suppliers on what
they must submit with their offer. The information submitted is
used to evaluate offers or proposals.
1.0 Foreign ownership, control, or influence (FOCI) is a
concern. For any software product that the supplier intends
to acquire or develop, the supplier shall answer the following
questions: [Note: Insert appropriate questions as shown in
the sample questionnaires in the “Software Supply Chain
Risk Management and Due-Diligence” pocket guide
series or, if dealing with the US Government contracts,
instruct the offerors to complete the Office of Management
and Budget (OMB) Standard Form 328, “Certificate
Pertaining to Foreign Interests.”]
2.0 Due-Diligence Questionnaire. Offerors shall complete the
SwA due-diligence questionnaire attached to this RFP.
3.0 Software Assurance Case
3.1 In order for the Acquirer to evaluate the proposed
software assurance capabilities, the potential
suppliers must submit an initial Software Assurance
Case in accordance with ISO/IEC 15026, Systems
and software engineering – Systems and software
assurance – Part 2: Assurance Case. Paragraph 3.2
below identifies the minimum that should be included
in the initial assurance case. The initial Software
Assurance Case shall subsequently become a part
of the contract and be used by the Acquirer as initial
acceptance conditions.
3.2 It is understood that the initial Software Assurance
Case will be broad in nature because potential
suppliers will not know all the details of safety and
26
Software Assurance Pocket Guide Series:
Software Assurance in Acquisition and Contract Language
27
Acquisition & Outsourcing, Volume I – Version 1.1, July 31, 2009