Addressing Today's Software Risks Requires an Assurance-Educated Workforce

There is a significant gap in the current acquisition and engineering workforce's knowledge, skills, and support resources needed to address software and supply chain risk. This gap is widened by two factors: the growing reliance on software to handle system functionality and the exponential increase in cyber attacks. These factors underscore the importance of ensuring that all acquisition software functions as intended and is free from vulnerabilities that can create or contribute to existing cybersecurity issues. However, acquirers, developers, program managers, systems engineers, and decision makers typically lack the knowledge required to create and comply with these requirements. Determining who should be trained and how they should be trained has been an ongoing discussion in the software community for several years. In this paper, we summarize the efforts currently underway to address gaps in workforce knowledge, skills, and support resources based on recent publications and panel discussions held by the Software Assurance Supply Chain (SSCA) forum.