Loading story…
The UK government has published a voluntary Software Security Code of Practice aimed at improving the security and resilience of software supplied to businesses and reducing software supply chain risk. Co-designed by the National Cyber Security Centre (NCSC) with industry and academic experts, the code sets out 14 principles across four areas: secure design and development, build environment security, secure deployment and maintenance, and communication with customers. It is primarily targeted at senior leaders in software vendor organizations, who are expected to appoint a Senior Responsible Owner to drive implementation and accountability.
Alongside the code, the NCSC released Assurance Principles and Claims guidance to help vendors self-assess whether they meet a baseline level of software security and resilience. The assessment framework covers controls such as secure development practices, third-party component management, testing, threat modelling, build environment access control, vulnerability disclosure, patching, and customer notification, with evidence drawn from documentation, interviews, and audits. The government said the code has been aligned where possible with international frameworks including the US Secure Software Development Framework and the EU Cyber Resilience Act, and is being supported with implementation guidance, a self-assessment form, and plans for a future certification scheme.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 7 May 2025, the NCSC published version 1.0 of its Assurance Principles and Claims guidance to help software vendors self-assess compliance with the Software Security Code of Practice and support evidence-based assurance.
On 7 May 2025, the UK government published a voluntary Software Security Code of Practice for software vendors, setting out 14 principles across four themes to improve software security and resilience.
The UK government refined the Software Security Code of Practice using feedback from a public call for views conducted from May to August 2024.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government has launched a voluntary **Cyber Resilience Pledge** at 10 Downing Street, asking companies to elevate cybersecurity to a board-level responsibility, enroll in the National Cyber Security Centre’s **Early Warning** service, and push suppliers toward **Cyber Essentials** certification or an equivalent baseline. The initiative includes a 30/60/90-day timetable for organizations to register for warning services, assess supplier coverage, and implement the Cyber Governance Code of Practice with annual board training. More than 60 organizations signed at launch, including over 20 of the government’s 39 strategic suppliers and companies such as Aviva, London Stock Exchange Group, Marks & Spencer, and Capita. The rollout drew scrutiny because uptake among major British firms was limited, with fewer than 15 **FTSE 350** companies joining despite ministers having written to every FTSE 350 chair and chief executive months earlier. The pledge has no enforcement mechanism, raising questions about whether it is primarily a public commitment ahead of possible future regulation through the proposed **Cyber Security and Resilience Bill**. The launch comes as cyber incidents continue to rise in the UK, with attacks estimated to cost organizations **£14.7 billion annually** and the NCSC reporting **204 nationally significant incidents** in the year to September 2025, up from 89 the previous year.
Jul 9, 2026
Government and industry leaders are intensifying efforts to address software supply chain security, with a particular focus on the adoption of Software Bills of Materials (SBOMs) and the potential for holding software vendors liable for security failures. In the United States, the push for SBOMs has been driven by federal policy, but private sector adoption remains slow, even as the rapid evolution of AI-assisted coding introduces new complexities and risks. Experts are divided on whether AI will reduce or exacerbate vulnerabilities, but there is consensus that transparency in software components remains critical for managing security risks. In the United Kingdom, lawmakers are calling for significant regulatory changes, including introducing liability for software developers, incentivizing cyber resilience investments, and mandating incident reporting. These recommendations come in response to a series of high-profile cyber incidents, such as the attack on Jaguar Land Rover, which have underscored the economic and public risks posed by insecure software. The debate continues between industry groups, who warn that liability could stifle innovation, and security leaders, who argue that the current system leaves critical infrastructure and the broader economy exposed to escalating cyber threats.
Jul 12, 2026
CISA, the NSA, and international partners published joint guidance urging software manufacturers and online service providers to formalize **coordinated vulnerability disclosure (CVD)** programs for working with external security researchers. The guidance calls for organizations to publish a clear vulnerability disclosure policy, define internal processes for receiving, triaging, remediating, and disclosing reported flaws, and assign **CVE** identifiers where appropriate to improve tracking and transparency. The document also recommends using third-party coordinators such as **CISA** or national **CSIRTs** when organizations need support handling disclosures, and it highlights **safe harbor** language to protect good-faith researchers from legal action. CISA said the practices can help vendors strengthen product security and give customers and critical infrastructure operators a way to assess a supplier’s maturity in handling vulnerability reports and remediation.
Jul 16, 2026