On 20 July 2026 the President signed Executive Order 14415, "Securing America's Defense Supply Chains and Ensuring Domestic Acquisition of Critical Materials." It is mostly about materials and domestic sourcing, but software appears in two places that matter to anyone who sells to defense primes: the definition of a critical supply chain and the bill of materials contractors would have to submit. The order is an instruction to agencies. It does not, by itself, put new duties on your company.
What's affected
From the published text:
- Section 3(a) directs the Secretary to require "all prime contractors and subcontractors at any tier to map and illuminate" critical supply chains.
- Section 3(b)(i) requires tracing "components, parts, equipment, software, and materials back to the origin of raw materials," and the submission of "a complete indentured Bill of Materials" to the Department of War.
- Section 7(a) defines a critical supply chain as all tiers of suppliers and subcontractors providing "goods, materials, systems, software, or services" that are essential to contract deliverables, mission assurance, security or resilience, "as defined by the Secretary."
- Section 7(b) defines the indentured bill of materials as covering components, parts, software and materials back to the origin of raw materials, in a standard format set by contract data item descriptions, with limited disclosure to support contractors.
There is no standalone software section. The text does not use the term SBOM and does not say what a software entry in an indentured bill of materials must contain. Do not assume it means CycloneDX or SPDX until the Department publishes its format.
Binding versus not binding
| Provision | Status |
|---|---|
| Executive order as a whole | Binding on executive agencies. Section 8(c) says it creates no private right enforceable at law or in equity, and section 8(b) makes implementation subject to appropriations and applicable law |
| Waivers under 10 U.S.C. 4872 stop from 1 January 2027 (Sec. 2(a)) | Fixed date, directed at the Department |
| Mapping policy and guidance (Sec. 3(a)) | Due within 180 days, so by about 16 January 2027 |
| Mapping regulations | Due 90 days after the guidance is complete |
| Contractor obligations to map and submit a BOM | Not yet in force. They depend on guidance, regulations and contract clauses |
| Regulatory action on alternative sources (Sec. 4(a)) | Initiation due within 180 days |
In short, you are not required to file anything today. You are required to be ready for a clause that arrives in 2027.
How to check if you're exposed
- Do you hold, or hope to hold, defense contracts or subcontracts, at any tier? The order says "any tier."
- Does your product or service fall inside what a prime could call essential to a deliverable? Section 7(a) leaves that definition to the Secretary.
- Can you list the software components in each product you deliver, with versions and suppliers? Run your manifest through an inventory tool such as the free scan at gold.safeguard.sh/scan. It runs in the browser, the file never leaves your machine, and it takes package.json, requirements.txt, CycloneDX or SPDX files, up to 100 dependencies per scan.
- Can you name your own suppliers' suppliers for the parts of the product you ship? Section 3 asks for tracing, not just a list.
What to do now
- Calendar two dates: 16 January 2027 for the Department's mapping guidance and 1 January 2027 for the waiver cutoff, if you supply materials or parts.
- Ask your prime customers whether they plan to flow down mapping requirements early, and what format they expect.
- Generate a component inventory for every deliverable and store it with the release.
- Identify the subcontractors and open-source dependencies you cannot trace beyond one level.
- Watch the Federal Register and the Department's acquisition notices for the guidance and the contract data item descriptions.
How suppliers can prepare
- Produce machine-readable inventories now. A format the Department defines later is easier to convert to from CycloneDX or SPDX than from a spreadsheet.
- Record supplier origin as well as version. The order asks for tracing back to origin, so name the publisher or vendor for each component.
- Keep an owner. Someone should be named for mapping responses, because the order sets 15-day and 45-day clocks after vetting for notice of significant risks and for a corrective action plan.
- Build a disclosure rule. Section 7(b) allows limited disclosure to support contractors, so decide in advance what you will share with whom.
- Do not over-claim. Tell customers you can produce inventories, not that you comply with a rule that has not been written.
Why it matters
Supply chain mapping used to be a hardware exercise: specialty metals, magnets, microelectronics. Naming software in the same sentence means the same traceability habits will be asked of code. For software suppliers the prudent reading is that the question "what is in this and where did it come from" is moving from a security-team curiosity to a contract data item.
It is also a reminder of how executive orders become obligations. The order sets deadlines for the Department, then regulations set deadlines for you. Between those two steps is the best window you will get to prepare.
This post is a summary of the published text and not legal advice.
Try it yourself
Click through it at your own pace, or open it full screen.
Then take one product, list each component, its version and its publisher, and mark the ones you could not trace to an origin.
Quick check
Does EO 14415 require software suppliers to submit an SBOM today?
No. It directs the Department of War to write policy and regulations. Contractor duties to map supply chains and submit an indentured bill of materials depend on those later steps.
Where does software appear in the order?
In section 3(b)(i), which lists software among the items to trace to the origin of raw materials, and in section 7, which includes software in the definition of a critical supply chain and of an indentured bill of materials.
When is the Department's mapping guidance due?
Within 180 days of the order, which is about 16 January 2027. The mapping regulations follow 90 days after the guidance is complete.
