Executive Order 14028, signed on 12 May 2021, directed NIST to publish software supply chain guidance, told OMB to make agencies follow it, and named SBOMs as a secure development practice. Most of the memos built on it have since been replaced, so check what still applies before citing it.
What section 4 asked for
Section 4 of the order is titled for software supply chain security. It does several separate things, and people often blur them together.
- It tells NIST to publish guidance on secure software development practices. Item 4(e) lists the practices, and item 4(e)(vii) includes "providing a purchaser a Software Bill of Materials (SBOM) for each product."
- Item 4(e)(ix) lists "attesting to conformity with secure software development practices" as one of those practices.
- Item 4(k) tells OMB to require agencies to comply with that NIST guidance for software they buy after the guidance is issued.
- Item 4(n) tells DHS to recommend contract language to the FAR Council, so that software suppliers comply with and attest to the practices.
The order sets deadlines for NIST work as well, such as 45 days for a definition of critical software and 60 days for security measures for it.
What it did not do
The order is a direction to government bodies. It did not itself put a duty on a software company. Duties on suppliers came through later documents, such as OMB memos and contract terms, and each of those had its own scope.
The order also did not publish an SBOM format. NIST and the NTIA produced the guidance and the minimum elements that followed. For that story, see the history of SBOMs from a 2014 bill to the NTIA minimum elements.
What happened next
The chain of documents is worth knowing in order:
- NIST published SP 800-218, the Secure Software Development Framework version 1.1, in February 2022.
- OMB issued M-22-18 on 14 September 2022 and M-23-16 on 9 June 2023.
- CISA published the Secure Software Development Attestation Form, which M-22-18 and M-23-16 point to.
- On 6 June 2025, Executive Order 14306 amended two other orders, EO 14144 and EO 13694. The text I read does not amend EO 14028 and does not use the word attestation. It did set NIST deadlines, including a preliminary SSDF update by 1 December 2025.
- On 23 January 2026, OMB memo M-26-05 rescinded M-22-18 and M-23-16.
Our timeline of federal software attestation from 2021 to 2026 walks through those dates, and what OMB M-26-05 changed for suppliers covers the latest step.
How to cite it correctly
If a contract or questionnaire says "per EO 14028," ask which document the buyer actually means. It may be the order, the NIST guidance, the old OMB memo, or the CISA form. The answers differ. A buyer may also be an agency that has chosen its own terms under the newer memo.
Do not describe the order as imposing a requirement on you unless your contract says so in its own words. The order directs agencies. Your obligations come from your agreement.
Quick check
Does EO 14028 still exist?
I found no text in EO 14306 that amends EO 14028, so treat the order as the origin document. The OMB memos that implemented its attestation approach were rescinded in January 2026.
Did EO 14028 require SBOMs from every vendor?
No. It listed providing an SBOM to a purchaser as one secure development practice for NIST guidance. Any actual requirement came from later memos and contract terms.
Sources
- Executive Order 14028 text, Federal Register 17 May 2021
- Executive Order 14306 text, Federal Register 11 June 2025
- OMB M-22-18
- OMB M-23-16
- OMB M-26-05
Last reviewed: 19 October 2026.
