Executive Order 14028: What It Means for Every Software Vendor

What the Order Actually Requires

EO 14028 directs the federal government to modernize its cybersecurity posture across several dimensions. For commercial software vendors, the most consequential section is Section 4: Enhancing Software Supply Chain Security. It requires the Department of Commerce and NTIA to publish minimum elements for a Software Bill of Materials (SBOM), and mandates that federal agencies require SBOMs from their software suppliers.

In plain terms: if you sell software to the U.S. government, you will need to produce an SBOM upon request. This is not optional. It is a condition of doing business with federal agencies.

The Three Core Mandates

The order creates three overlapping obligations for software vendors: First, maintain a Software Bill of Materials for every product delivered to federal customers — a machine-readable inventory of every open source and third-party component, with versions and license data. Second, be able to deliver that SBOM to a federal agency upon request, in a standard format (SPDX or CycloneDX). Third, attest to secure software development practices, confirming that your development lifecycle includes vulnerability testing, code reviews, and supply chain risk management.

Who Is Affected

The order applies to any entity that sells software products or services used by federal agencies. This includes traditional software vendors, cloud service providers offering SaaS to government customers, open source maintainers whose projects are used in federal systems, and managed service providers that deliver software as part of their engagements. The definition is intentionally broad — regulators did not want loopholes that would allow vendors to sidestep the requirements through creative contracting.

The Timeline That Followed

EO 14028 set a 60-day deadline for NTIA to publish SBOM minimum elements — a deadline met in July 2021 with the publication of "The Minimum Elements for a Software Bill of Materials." The NIST Secure Software Development Framework (SSDF) was subsequently updated. The Office of Management and Budget issued implementing memos (M-22-18, M-23-16) that set specific attestation deadlines for agency software procurement teams.

Getting Ahead of the Requirement

Organizations that treated EO 14028 as a future compliance problem rather than an immediate operational one found themselves scrambling when agency contracting officers started requiring SBOM attestations. The vendors who moved quickly — investing in SCA tooling, automating SBOM generation, and building license compliance programs — found that the compliance investment also improved their internal security posture significantly.

The first step for any software vendor is to establish an accurate component inventory for every product in their portfolio. That means implementing Software Composition Analysis in your CI/CD pipeline and generating SBOMs in SPDX or CycloneDX format on every release build.