Executive Order 14028 SBOM Requirements: What to Comply With and How

Executive Order 14028, issued in 2021, directed U.S. federal agencies to require software bills of materials from software suppliers, establishing SBOMs as a component inventory for improving supply-chain visibility in federal procurement. NTIA’s minimum elements define required data fields, automation support, and operational practices, while SPDX, CycloneDX, and SWID tags are recognized formats; NIST guidance and the Secure Software Development Framework further inform implementation. Although OMB M-26-05 rescinded the standardized secure-development self-attestation requirement in January 2026, it did not eliminate SBOM expectations, and agencies may still require them contractually under a risk-based approach. The requirements primarily affect federal vendors and integrators but have influenced private-sector contracts as organizations respond to risks highlighted by incidents such as SolarWinds and Log4Shell and increasing third-party breach involvement. The discussion emphasizes that SBOMs provide transparency rather than a complete assessment of risk, since inventories can produce many vulnerability alerts that may not be exploitable; it therefore recommends supplementing SBOMs with reachability analysis, VEX statements, exploit likelihood data, centralized management, and remediation planning to prioritize and safely address meaningful exposures.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.