FDCC Compliant

New requirements for the Fed Govt have been mandataed by OMB. All software used on desktops is now required to be FDCC compliant before we can use/purchase any additional software. We are currently using WINSCP 3.8.2 but another user has requested this and until we can obtain documentation that the software is FDCC compliant, they will not allow the user to have the software on their machine. Can you help or point me in the right direction? Thank you

Sorry, I do not know what FDCC is.

The FDCC is the new mandatory security requirements that follow the National Institute of Standards and Techology requirements for government computers. All applications that intend to run on desktops of federal computers will be required to be FDCC certified.

For more information visit: https://usgcb.nist.gov/

There are tools available on the website to certify your application. Since all federal agencies will only be allowed to use certified applications, it is to the benefit of the developer/vendor to make sure their application is certified, and advertise that fact on your site.

Hope this helps.
Joel Johnstone
USDA Forest Service

Also was not able to find the tools you refer to. Can you point me to them? Thanks.

I couldn't find relevant information or software either... English is my first language and I'm fairly used to official verbiage...

Did pick this out of Google, though:
https://svn.haxx.se/tsvn/archive-2007-10/0136.shtml

[ 1. The software has been tested to assure that it runs at "user level" ("power user" or "administrative" privilege is not necessary for the normal operation of the product)
2. The software does not change the core configuration of the desktop during installation ]

Perhaps someone can clarify what 'core configuration' means, beyond being a buzzword?

Those with concerns or operating restrictions that have bearing on install procedures might find the portable version handy --

https://portableapps.com/apps/internet/winscp_portable

-- WinSCP seems to store settings in an .ini rather than registry usage anyway, but the portable installer would give you a set of files that could just be copied into a user account, obviating the need for actual installation.

[ Since all federal agencies will only be allowed to use certified applications, it is to the benefit of the developer/vendor to make sure their application is certified, and advertise that fact on your site. ]

Do federal agencies often donate to OSS projects?

D wrote:

Those with concerns or operating restrictions that have bearing on install procedures might find the portable version handy --

https://portableapps.com/apps/internet/winscp_portable

Standalone version of WinSCP (winscp406.exe and similar) is also portable (it stores configuration into an INI file by default).

Do federal agencies often donate to OSS projects?

I do not think I ever received a donation from any government agency (of any country).

This issue has been added to tracker.