The Pentagon's New Software Security Directive Calls for Deeper Supply Chain Validation

In a July 2025 memorandum, the Department of Defense (DoD) Chief Information Officer (CIO) was tasked with ensuring that all software, hardware, and cloud services the DoD develops or procures are secured against foreign influence, particularly from China and Russia. This includes validating that compiled software and firmware are free from undeclared components, malicious functionality, and supply chain tampering, threats that often go undetected without binary analysis. 

Foreign-Controlled Software: Still a Hidden Attack Vector

Nation-state actors continue to target software supply chains, not just through direct attacks, but by attempting to influence the technologies used inside critical systems. The memo explicitly calls for the elimination or mitigation of adversarial influence across both hardware and software.

Salt Typhoon, a campaign covered in a recent NetRise webinar, demonstrated how malicious functionality can persist within device-level software, delivered through otherwise legitimate-looking updates. These kinds of threats aren’t always visible in source code or documentation. They’re often hidden deep in compiled binaries, where traditional certification processes offer little protection.

Existing Programs Leave Gaps Below the Surface

The DoD plans to strengthen several existing programs and processes, including:

• Cybersecurity Maturity Model Certification (CMMC)
• The Software Fast Track (SWFT) program
• Authority to Operate (ATO) processes
• The Federal Risk and Authorization Management Program (FedRAMP)
• The Secure Software Development Framework (SSDF)

These initiatives help standardize secure development and procurement. But they don’t always reveal what actually executes even if they promote transparency and secure procurement, often via SBOMs and application security testing.

These approaches mainly assess build-declared components. They overlook what’s added or altered during the build process, leaving critical blind spots, especially where malicious foreign-developed or deeply embedded components may evade detection.

Binary analysis fills that gap. By examining the final, compiled software, Binary Composition Analysis (BCA) verifies what's actually delivered, regardless of its origin, build process, or packaging. This capability is essential to fulfilling the intent of secure software mandates, especially for critical and sensitive systems.

Proving What Actually Executes

When software reaches the final stages of delivery, it has often passed through multiple suppliers, build systems, and component aggregators. Even when SBOMs are provided, they’re often incomplete, particularly those generated from source artifacts rather than final builds.

Binary Composition Analysis (BCA) helps you:

• Generate accurate and complete SBOMs directly from compiled code.
• Identify undeclared components.
• Detect tampering and suspicious additions at the binary level.
• Attribute provenance and supply chain integrity with evidence.
• Align with procurement and risk management requirements.

This approach transforms software trust from an assumption into something you can prove.

What the Defense Industrial Base Should Expect

The memo directs the DoD CIO to issue follow-up implementation guidance within 15 days of the memo’s release. That may include stronger inspection mandates, new binary validation workflows, or raise the bar for how vendors demonstrate software integrity.

While the memo doesn’t ban all foreign-developed software outright, it signals a growing concern around how adversaries could exploit gaps in the software supply chain. Detecting undeclared or tampered components is now a baseline expectation, not just a security best practice.

If you build or deliver software, hardware, or cloud services to the DoD, now is the time to prepare. Future contracts may depend on your ability to show what’s inside your software, and prove it’s safe to use. 

NetRise Helps You Meet the Moment

NetRise delivers the deep visibility that traditional tools miss. Our platform inspects final software and firmware to generate binary-derived SBOMs, uncover tampering, and trace supply chain origin with precision.

Whether you build software or buy it, we help you understand what actually executes inside your systems, and give you the evidence to prove you’re meeting evolving DoD requirements. 

Learn more about the NetRise platform today!