CISA tool aims to boost security for software onboarding

**CISA** released a free, interactive web tool based on its Software Acquisition Guide to help organizations embed Secure by Design/Default practices into software procurement, offering structured risk questions, exportable summaries, and baseline supplier requirements; experts praise its ability to shift security left and standardize evaluations (e.g., SBOM/VEX, provenance, disclosure, logging, assurance), while critics argue it is cumbersome, evidence-free, and not machine-readable—highlighting the need for automation, verifiable artifacts, and scalable third-party risk workflows to meet modern software supply chain threats.