This report discusses how the BloSS@M approach was designed to align with federal asset management and cybersecurity requirements, including OMB Circular A-130, OMB Memorandum M-13-13, NIST SP 800-37, and NIST SP 800-53. The framework introduces a shared software acquisition and management infrastructure intended to increase efficiency, improve visibility, and strengthen software supply chain security.
Overview
Key Features Introduced in the Internal Report
BloSS@M promotes a coordinated acquisition strategy that enables organizations to leverage government-wide purchasing power, reduce duplicate purchases, and improve vendor negotiations.
The framework uses blockchain technology to maintain a tamper-resistant record of software assets throughout their entire life cycle, providing verifiable provenance from acquisition through retirement.
By integrating with the National Vulnerability Database (NVD), BloSS@M can automatically identify and track newly disclosed vulnerabilities affecting deployed software assets.
The framework incorporates the Open Security Controls Assessment Language (OSCAL) to support machine-readable compliance information, automated assessments, continuous monitoring, and scalable asset management processes.
Although the primary focus of BloSS@M is software assets, the underlying architecture can also support hardware asset management when paired with appropriate physical delivery and recovery mechanisms.
Although the primary focus of BloSS@M is software assets, the underlying architecture can also support hardware asset management when paired with appropriate physical delivery and recovery mechanisms.
Public Comment Opportunity
NIST is seeking feedback from federal agencies, industry stakeholders, researchers, and members of the cybersecurity community. The public comment period remains open through June 26, 2026.
Click above to learn how to submit your feedback on the BloSS@M NIST Internal Report 8500A.