The main response to the increasing alarm regarding the risks posed by
foreign-sourced software has been to rethink how acquisition is done and to
provide guidance (although not yet policy or legislation) to aid the acquirer
in attaining some level of confidence in the trustworthiness of the software