of the risks associated with commercial software acquisition, and the
recommendations for risk mitigation.
Reports from the Government Accountability Office (GAO) in 2005
and 2006 [49] reinforced the DSB’s message that the software used in US