GAO's April 2024 report GAO-24-106343 reviewed how federal agencies had implemented Executive Order 14028, the 2021 order to strengthen defenses against cyberattacks. It found 49 of 55 leadership and oversight requirements fully complete as of March 2024, with work still needed on securing critical software in the supply chain.
What the order contains
GAO says the order has 115 provisions, including 55 leadership and oversight requirements, with CISA, NIST and OMB as the main responsible agencies.
Where things stood
As of March 2024 GAO counted 49 of the 55 requirements fully complete, five partially complete and one not applicable. The remaining gaps include securing critical software in the supply chain and ensuring agencies have enough resources.
GAO also found the order directly addresses five of its ten high risk cybersecurity action areas. Other recent strategies could cover the remaining five if implemented well.
Recommendations
GAO made five recommendations, two to DHS and three to OMB. By November 2024 one DHS recommendation, to publish a list of critical software, was closed as implemented. The other four were open. They cover documenting steps to improve the Cyber Safety Review Board, and showing cost analyses and resourcing coordination with other agencies.
Why a vendor should care
Software supply chain work in the order is the part most visible to suppliers. If you sell to government, expect questions about how you build and secure software. This report shows it was a work in progress, not a finished regime, so check current requirements with your contracting contact.
What teams can do regardless
- Keep SBOMs for each release.
- Document your secure development practices in plain language.
- Track vulnerability handling times.
- Keep evidence in one place so questionnaires take hours, not weeks.
What GAO does not say
The report does not say that any specific vendor attestation is required of you. Requirements change over time and differ by contract, so confirm with the buyer.
Safeguard's SBOM and dependency scanning and compliance and evidence automation help produce this kind of documentation. Whether a customer accepts it is for the customer to say.
How to prepare for buyer questions
Collect five short documents: how you build and release software, how you handle vulnerabilities, how you manage access to source code, a sample SBOM, and your incident notification process. Keep them current and dated. When a buyer asks, you can answer from facts you already hold. Avoid claiming any certification or attestation you do not have, and describe in-progress work as in progress.
Try it yourself
Click a control and see how one piece of evidence maps to more than one framework.
Click through it at your own pace, or open it full screen.
Quick check
How many requirements were complete?
GAO counted 49 of 55 leadership and oversight requirements fully complete as of March 2024.
Is this report current guidance for vendors?
No. It is a snapshot from 2024. Check the latest buyer and agency requirements.
Sources
Last reviewed: 19 October 2026.
