Chris DeRusha, the federal chief information security officer, said the focus on securing commercial software comes from the cyber executive order.