# Tomabechi Proposes DevSecOps Procurement

Hideto Tomabechi’s policy and engineering paper proposes a two-stage approach for government cyber resilience, drawing on PHP2Shell and the history of ARPANET, UNIX, and Mach to argue for stronger security across existing systems. It recommends that agencies use procurement to advance asset and software-component inventories, rapid and verifiable updates, secure development and deployment evidence, least-privilege isolation, and incident-response readiness, alongside a staged migration of high-risk components to memory-safe languages. The paper is a proposal, not legislation, and identifies no enacted appropriations or bill-specific funding.

- Agencies and acquisition teams can translate the proposals into solicitation and contract evaluation criteria for inventory completeness, patching, secure development evidence, and incident-response readiness.
- Contractors providing software or systems should be prepared to document component inventories, update processes, isolation controls, and memory-safety roadmaps; the paper proposes targeted migration rather than an immediate government-wide rewrite.
- The paper also proposes shared security testing, foundational open-source software maintenance, and independent assessment as potential procurement or investment areas, without specifying contract vehicles, values, or timelines.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity, Digital Infrastructure
**Published:** October 25, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- National Institute of Standards and Technology (NIST)
- Federal Bureau of Investigation (FBI)

### Vendors
- Amazon ()
- Cloudflare ()
- Palo Alto Networks ()

### Sources
- [Policy and engineering paper For government officials
Reengineering National Cyber Resilience Around Existing Systems
A Two-Stage DevSecOps Policy Informed by PHP2Shell, the History of ARPANET, UNIX and Mach, and Memory Safety
Hideto Tomabechi

https://t.co/OwYSdj9SpG

Abstract
I](https://x.com/DrTomabechi/status/2114505445734072363) - twitter-fed-procurement