Section 4(e) of EO 14028 told NIST to issue guidance on ten areas: secure build environments, conformance artifacts, trusted code, vulnerability checks, tool artifacts, provenance, SBOMs, vulnerability disclosure, attestation, and open source integrity. The CISA attestation form's appendix maps to four of those clauses directly.
Why this clause matters
The 2021 order is where the federal supplier attestation idea started. Section 4(e) asked NIST to issue guidance identifying practices that enhance software supply chain security, and the SSDF and later the CISA form trace back to it. Knowing the ten clauses helps you read any later document that cites them, such as the SSDF appendix that lists "4e(ix)" next to many tasks.
The ten clauses in plain words
| Clause | In plain words |
|---|---|
| (i) | Secure development environments: separate build environments, audited trust, MFA and conditional access, minimized dependencies on enterprise tools used in builds, encryption, monitoring and incident response |
| (ii) | Produce, and give a purchaser on request, artifacts that show you followed clause (i) |
| (iii) | Use automated tools or comparable processes to keep source code supply chains trustworthy |
| (iv) | Use automated tools or comparable processes to check for known and potential vulnerabilities and fix them, at least before each release |
| (v) | Give a purchaser on request the artifacts of those tool runs, and publish summary information on the risks assessed and mitigated |
| (vi) | Keep accurate, current data on the origin of code and components, with controls and recurring audits |
| (vii) | Give each purchaser an SBOM for each product, directly or by publishing it |
| (viii) | Take part in a vulnerability disclosure program with a reporting and disclosure process |
| (ix) | Attest to conformity with secure development practices |
| (x) | Ensure and attest, to the extent practicable, to the integrity and provenance of open source used in a product |
Which clauses the CISA form touches
The form's appendix lists EO 14028 subsections next to each attestation item: 4e(i) for item 1, 4e(iii) for item 2, 4e(vi) for item 3 and 4e(iv) for item 4. The form does not itself ask for an SBOM or for tool artifacts. Those come through other channels, such as an agency's own contract terms.
That is a useful reminder: the attestation was one of several things the order asked of suppliers. A buyer who has read the order may also ask for the artifacts in (ii) and (v), or an SBOM under (vii).
Using the table
- Ask which clause a buyer's question comes from. A request for "proof of your scan runs" is clause (v), not the attestation.
- Prepare the artifacts once. A good evidence folder serves (ii), (v) and the form at the same time.
- Check your SBOM story separately. Clause (vii) is about delivering an SBOM, and CISA's 2026 minimum elements document is the current reference for what to include.
- Review open source handling. Clause (x) is about integrity and provenance of open source inside your product, and it ties to the form's third party component language.
What changed since
The order's text remains as published in the Federal Register. OMB M-26-05, issued January 23, 2026, rescinded M-22-18 and M-23-16 but says agencies should still validate provider security "utilizing secure development principles" and may choose to use the attestation form or ask for a current SBOM. For a background timeline, see the federal software attestation timeline.
Quick check
Is EO 14028 section 4(e) a requirement on suppliers directly?
It directs NIST to issue guidance, and other parts of the order direct agencies. Obligations on a supplier arrive through agency policy and contract terms, so check your own contract.
Which clause covers SBOMs?
Clause (vii), providing a purchaser an SBOM for each product directly or by publishing it on a public website.
Sources
- EO 14028, Federal Register
- CISA Secure Software Attestation common form, appendix
- OMB M-26-05
- CISA 2026 Minimum Elements for an SBOM
Last reviewed: 19 October 2026.
