@AevaOnline Here are some materials that may be worth considering for this section: - [CISA Secure by Design Software Acquisition Guide best practices](https://www.cisa.gov/sites/default/files/2024-07/PDM24050%20Software%20Acquisition%20Guide%20for%20Government%20Enterprise%20ConsumersV2_508c.pdf) - [CISA Secure by Design Software Acquisition Guide best practices Spreadsheet](https://www.cisa.gov/sites/default/files/2024-08/PDM24064%20Software%20Acquisition%20Guide%20for%20Government%20Enterprise%20Consumers%20Final-%2020240710_v19.xlsx) - [CISA Secure by Design Software Acquisition Guide best practices FACT Sheet](https://www.cisa.gov/sites/default/files/2024-10/ICT%20SCRM%20Task%20Force%20Software%20Acquisition%20Guide%20Fact%20Sheet%20%28508%29.pdf) - [NASA Supply Chain Risk Management Attestation Collection Process Presentation](https://www.nasa.gov/wp-content/uploads/2024/08/secure-software-development-self-attestation-collab-opp-3-073124-week-3.pdf?emrc=662d71) - [NASA Supply Chain Risk Management Attestation Collection Process Meeting Video Recording](https://www.nasa.gov/wp-content/uploads/2024/08/nasas-secure-software-development-self-attestation-collaboration-opportunity-20240731-113203-meeting-recording.mp4) - [Example of an open source product with steward supplied attestation artifiacts](https://github.com/rjb4standards/CISASAGReader?tab=readme-ov-file#how-long-did-it-take-to-produce-the-cisasagreader-sbom-vdr-vrf-and-cisa-software-acquistion-guide-spreadsheet-attestation-artifacts) - [NIST SP 800-161r1 product Vulnerability Disclosure Report article](https://www.energycentral.com/intelligent-utility/post/what-is-a-nist-sbom-vulnerability-disclosure-report-vdr-C1A40dhnYZxARMa)
@AevaOnline Here are some materials that may be worth considering for this section: