Chris DeRusha, the federal chief information security officer in OMB, said agencies and vendors need time to understand and implement NIST’s new Secure Software Development Framework.