Download Free Electronic Document

FormatFile SizeNotes
PDF file 0.1 MB

Use Adobe Acrobat Reader version 10 or higher for the best experience.

The nation's reliance on computer software to run and manage critical business services has increased dramatically over many decades and only continues to grow. But with this reliance comes risk. The increasing rate of and impact from the exploitation of software vulnerabilities has caused billions of dollars of damage and losses to thousands of companies across the world. And the malicious compromise — or even accidental failure — of software threatens firms across all industries throughout the United States. Moreover, it has become increasingly true that modern software applications are built on a foundation of third-party and open-source software components, developed by thousands of professional and volunteer contributors across the world. This complexity and decentralized nature of the modern software ecosystem mean that firms are more separated from the oversight of the software that runs their businesses and increasingly exposed to risks because of this expanding software supply chain. Although many federal government agencies are vocal in addressing this issue in their own way, the U.S. Securities and Exchange Commission (SEC) has been relatively quiet. This Perspective presents a set of proposed disclosure rules that the SEC could implement to help address software supply chain security.

Research conducted by

This Perspective was conducted with support from RAND Institute for Civil Justice and the Kenneth R. Feinberg Center for Catastrophic Risk Management and Compensation

This publication is part of the RAND Corporation Perspective series. RAND Perspectives present expert insights on timely policy issues. All RAND Perspectives undergo peer review to ensure high standards for quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit

The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.