Tactics, Techniques, & Procedures (TTP) for Analyzing the Use of Open Source Software (OSS) in Software Development Enclaves

The objective of AF254-0810 “Tactics, Techniques, & Procedures (TTP) for Analyzing the Use of Open-Source Software (OSS) in Software Development Enclaves” is to develop standardized Tactics, Techniques, and Procedures (TTPs) for analyzing the security and operational risks associated with the use of Open Source Software (OSS) in software development enclaves, particularly within environments seeking Risk Management Framework (RMF) Authority to Operate (ATO). This effort will research and synthesize current OSS risk assessment models, secure software development lifecycle (SSDLC) practices, and supply chain security strategies, tailored for application in Operational Technology (OT) and control system domains.The proposed work will produce a prototype framework for evaluating OSS component trustworthiness using structured metrics (e.g., vulnerability history, project activity, contributor reputation), along with draft TTPs suitable for integration into DevSecOps pipelines. These tools will support RMF authorization processes (e.g., software component list, PPS, Risk Assessment, and other pertinent deliverables), Zero Trust adoption, and continuous ATO (cATO) workflows across DoD environments.