1、O P E NS O U R C E S O F T W A R E S E C U R I T Y R F I S U M M A R Y SUMMARY OF THE 2023 REQUEST FOR INFORMATION ON OPEN-SOURCE SOFTWARE SECURITYAUGUST 2024 O P E NS O U R C E S O F T W A R E S E C U R I T Y R F I S U M M A R Y 2 O P E NS O U R C E S O F T W A R E S E C U R I T Y R F I S U M M A R

2、 Y ACKNOWLEDGEMENTS This Summary of the 2023 Open-Source Software Security Request for Information Report(RFI)is an outcome of the vast amount of time,energy,and expertise dedicated by U.S.federal government representatives from the Open-Source Software Security Initiative(OS3I).We offer our sincere

3、st gratitude to the technical and policy experts that undertook the analysis of the RFI submissions from the Center for Medicare and Medicaid Services(CMS),Cybersecurity and Infrastructure Security Agency(CISA),Defense Advanced Research Projects Agency(DARPA),Department of Homeland Security(DHS),Gen

4、eral Services Administration(GSA),Lawrence Livermore National Laboratory(LLNL),National Institutes of Standards and Technology(NIST),National Science Foundation(NSF),National Security Agency(NSA),Office of the Director of National Intelligence(ODNI),Office of Management and Budget(OMB),Office of the

5、 National Cyber Director(ONCD),Office of Science&Technology Policy(OSTP),Office of Secretary of Defense,Chief Digital Artificial Intelligence Office-Defense Digital Service(DDS).3 O P E NS O U R C E S O F T W A R E S E C U R I T Y R F I S U M M A R Y OS3I TABLE OF CONTENTS Executive Summary.5 Backgr

6、ound.6 Key Findings.7 Analysis.9 Secure Open-Source Software Foundations.9 Sustaining Open-Source Software Communities And Governance.10 Behavioral And Economic Incentives To Secure The Open-Source Software Ecosystem.11 Research&Development/Innovation.12 International Collaboration.13 OS3I Actions i