Key takeaways
- Executive Order 14028, "Improving the Nation's Cybersecurity," is the single US policy document most responsible for making SBOM a mainstream procurement term.
- EO 14028 runs to ten numbered sections.
- Section 4 is where most of the order's lasting technical impact sits.
- A device or software maker reading only the 2021 text would miss a real complication: EO 14028's legal text and its practical enforcement have diverged since the 2025 change of administration.
Executive Order 14028, "Improving the Nation's Cybersecurity," is the single US policy document most responsible for making SBOM a mainstream procurement term. Signed by President Biden on 12 May 2021 and published in the Federal Register at 86 FR 26633 on 17 May 2021, it is a U.S. government work carrying no copyright. Its Section 1 frames the stakes plainly: "the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security." Five years on, the order's text is still formally in force, but by late 2026 a new administration's OMB has rescinded the memoranda that had made several of its software-supply-chain mandates government-wide requirements — a nuance a device or software maker selling into the US federal market needs to track accurately rather than assume from the order's headline reputation alone.
What the order actually covers, section by section
EO 14028 runs to ten numbered sections. The table below summarizes each per the order's own text:
| Section | Title | What it does |
|---|---|---|
| 1 | Policy | States cybersecurity is a top national-security priority |
| 2 | Removing Barriers to Sharing Threat Information | Directs OMB to revise federal acquisition regulations within 60 days so IT/OT service providers can share threat data with CISA and the FBI |
| 3 | Modernizing Federal Government Cybersecurity | Requires agencies to move toward cloud architectures, implement Zero Trust Architecture, and deploy MFA/encryption within 180 days |
| 4 | Enhancing Software Supply Chain Security | The order's longest section (subsections a–x); covers NIST secure-development guidance, SBOM, "critical software," and vendor attestation — detailed below |
| 5 | Establishing a Cyber Safety Review Board | Creates an inter-agency board, with private-sector members, to review significant cyber incidents |
| 6 | Standardizing the Federal Government's Playbook for Responding to Cybersecurity Vulnerabilities and Incidents | Orders CISA to publish a standard incident-response playbook agencies must follow or justify exceeding |
| 7 | Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Networks | Requires agency-wide Endpoint Detection and Response (EDR) deployment and CISA data-sharing agreements |
| 8 | Improving the Federal Government's Investigative and Remediation Capabilities | Sets logging requirements and mandates agencies provide logs to CISA/FBI on request |
| 9 | National Security Systems | Directs the Secretary of Defense to apply equivalent requirements to National Security Systems within 60 days |
| 10 | Definitions | Defines 11 terms used throughout the order, including "Zero Trust Architecture" and "Software Bill of Materials" |
Section 10(j) defines SBOM itself as "a formal record containing the details and supply chain relationships of various components used in building software," comparing it, in the order's own words, to "a list of ingredients on food packaging" — the analogy that's since become the standard shorthand across the SBOM industry.
Section 4: the software supply chain mandate, subsection by subsection
Section 4 is where most of the order's lasting technical impact sits. Selected subsections, per the order's own text:
| Subsection | Deadline | What it requires |
|---|---|---|
| 4(b) | 30 days | NIST solicits input from government, industry and academia on supply chain security practices |
| 4(c) | 180 days | NIST publishes preliminary guidelines for enhancing software supply chain security |
| 4(e) | 90 days after 4(c) | NIST guidance must include standards for secure development environments, artifact generation, and automated vulnerability tooling |
| 4(f) | 60 days | Commerce (via NIST) publishes minimum elements for an SBOM |
| 4(g) | 45 days | Commerce/NIST defines "critical software" |
| 4(h) | 30 days after 4(g) | CISA identifies categories of software meeting the critical-software definition |
| 4(i) | 60 days | NIST publishes security measures specifically for critical software |
| 4(n) | 1 year | DHS recommends FAR contract language requiring vendors to attest to compliance with subsections (g)–(k) |
| 4(t) | 270 days | NIST identifies IoT cybersecurity criteria for a consumer device labeling pilot |
| 4(u) | 270 days | NIST identifies secure-development criteria for a consumer software labeling pilot, considering "a tiered software security rating system" |
Two threads from this table are worth separating because they are often conflated: the SBOM minimum-elements work (4(f)), which fed directly into NTIA's published minimum elements — see our dedicated SBOM minimum elements guide — and the vendor attestation requirement (4(n) onward), which produced the CISA "Secure Software Development Attestation Form" covered in its own attestation form guide. This guide is about the order that originated both mandates, not a restatement of either resulting document's technical content.
What changed by 2026: amendment vs. implementation rollback
A device or software maker reading only the 2021 text would miss a real complication: EO 14028's legal text and its practical enforcement have diverged since the 2025 change of administration.
- The order's text has not been revoked. Executive Order 14306, "Sustaining Select Efforts to Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144," signed 6 June 2025, amends two other executive orders (EO 13694 and EO 14144, a separate, later Biden-era order) — it strikes one sentence from EO 14144 that referenced EO 14028's threat-sharing directive, but it does not itself rescind or amend EO 14028. Federal Register's own index tracks EO 14028 as in force, amended only indirectly through this and similar later orders.
- OMB has rescinded the memos that operationalized Section 4's attestation mandate. Per contemporaneous legal-alert reporting on OMB Memorandum M-26-05, "Adopting a Risk-Based Approach to Software and Hardware Security" (23 January 2026), OMB rescinded M-22-18 ("Enhancing the Security of the Software Supply Chain through Secure Software Development Practices") and its companion M-23-16, which had made the Secure Software Development Attestation Form and a standardized, government-wide attestation collection process mandatory. M-26-05 reportedly criticizes the prior approach as having "imposed unproven and burdensome software accounting processes that prioritized compliance over genuine security investments," and shifts responsibility to each agency to apply "a comprehensive risk assessment" instead of a single common process. Agencies "may choose to use" the existing Common Form voluntarily, but collecting it is no longer a government-wide requirement. This guide has not independently rendered OMB's own memo PDF as extractable text, so the exact memo date and quoted language above should be confirmed against OMB's own publication before citing it in a compliance filing.
The practical upshot for a vendor: EO 14028 remains the historical and still-formally-valid origin point for SBOM, critical-software, and secure-development-attestation requirements in US federal procurement, but by late 2026 individual agencies — not a single government-wide OMB mandate — decide whether and how to enforce the attestation piece specifically. SBOM expectations, by contrast, have proven stickier in practice: NTIA's minimum elements and CISA's SBOM guidance continue to circulate as reference baselines independent of the attestation memo's fate.
A workable starting point
Read Section 4 directly if you sell to the US federal government, rather than relying on a summary — the subsection letters (4(e), 4(f), 4(g), 4(n)) map to distinct, separately-tracked NIST/CISA/OMB deliverables, and a vendor's actual obligation depends on which specific downstream guidance an agency's contract cites. Separate the SBOM question from the attestation questionM-26-05's rescission affects the government-wide attestation mandate; it does not, on its own public reporting, eliminate SBOM expectations that individual agencies or specific contract clauses still carry forward. Check with the specific contracting agency, not just OMB's top-level guidance, since M-26-05 explicitly pushes risk-based decisions down to each agency rather than keeping a single rulebook. Track NIST SP 800-218 (the Secure Software Development Framework) and the SBOM minimum elements independently of the executive order itself— those technical documents keep being cited and updated regardless of which OMB memorandum currently makes them mandatory. Re-verify this guide's "current status" claims against the Federal Register and OMB's own site before relying on them, given how much has changed via OMB memoranda (rather than a published, easily-citable executive order) since 2025.
SoftWSP builds the firmware SBOM and vulnerability-handling evidence that both the original EO 14028 Section 4 mandate and its successor agency-by-agency risk assessments expect from a device or software vendor, regardless of which specific memorandum is currently in force: see device & firmware security.
This guide summarises a public US executive order, a public OMB memorandum (reported via a law-firm alert where the OMB PDF itself did not render as extractable text), and contemporaneous legal-alert reporting; it does not constitute legal or compliance advice, and a reader with an active federal contract should confirm current requirements with their contracting officer.
Sources
- Federal Register / govinfo.gov: Executive Order 14028 of May 12, 2021, Improving the Nation's Cybersecurity (86 FR 26633, 17 May 2021)
- Federal Register: Executive Order 14028 — document and amendment history index
- Federal Register / govinfo.gov: Executive Order 14306, Sustaining Select Efforts to Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144 (6 June 2025)
- OMB: Memorandum M-26-05, Adopting a Risk-Based Approach to Software and Hardware Security (PDF, whitehouse.gov, January 2026)
- Wiley: "OMB Rescinds Secure Software Development Mandate in Favor of a Risk-Based Approach" (law firm alert quoting M-26-05 directly — used because the OMB PDF above did not render as extractable text this run)
Frequently asked questions
What is Executive Order 14028?
Executive Order 14028, "Improving the Nation's Cybersecurity," was signed by President Biden on 12 May 2021 and published in the Federal Register on 17 May 2021 (86 FR 26633-26647). Its Section 1 states that "the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security," and the order directs federal agencies, NIST, OMB, CISA and DHS across ten numbered sections covering threat-information sharing, cloud/zero-trust modernization, software supply chain security, a Cyber Safety Review Board, incident-response playbooks, endpoint detection, logging, and National Security Systems. It is a U.S. government work and carries no copyright.
What does EO 14028 require for software supply chain security and SBOM?
Section 4, "Enhancing Software Supply Chain Security," is the order's longest section, running from subsection (a) to (x). Subsection 4(e) (90 days after NIST's preliminary guidelines under 4(c)) directed NIST to issue guidance covering "secure software development environments," artifact generation and retention, use of automated tools, and, per subsection 4(f) (60 days), that "the Secretary of Commerce, acting through the Director of NIST... shall publish minimum elements for an SBOM." NIST's resulting guidance and NTIA's SBOM minimum-elements work are covered in detail in our [firmware SBOM](/guides/firmware-sbom/) and [SBOM minimum elements](/guides/sbom-minimum-elements/) guides; this guide covers the executive order that originated those mandates, not the resulting technical documents themselves.
What is "critical software" under EO 14028, and why does it matter?
Subsection 4(g) (45 days) directed NIST to "publish a definition of the term 'critical software'" based on factors including "the level of privilege or access required to function," integration and dependencies with other software, direct access to networking/computing resources, and "potential for harm if compromised." Subsection 4(h) then required CISA to identify categories of software meeting that definition, and subsection 4(i) (60 days) directed NIST to publish security measures specifically for it. The chain exists because the order treats generic software requirements as insufficient for the components a compromise of which would have outsized impact — agencies had to prioritize that software category first under subsequent OMB guidance.
Does EO 14028 apply outside the US federal government?
Not directly. EO 14028 binds federal agencies and, through OMB and FAR Council action, the vendors that sell software and services to those agencies — it creates no legal obligation on a company that does not sell into the US federal market. In practice, though, its NIST-authored guidance (the Secure Software Development Framework, SP 800-218; the NTIA/CISA-adopted SBOM minimum elements) became widely cited reference points well beyond federal procurement, the way ISO or NIST standards often do even where not legally mandated — see also our guide to the [attestation form](/guides/secure-software-development-attestation-form/) that implements part of Section 4 for actual federal vendors.
Is EO 14028 still in effect, and has it been rescinded?
The order's own text has not been revoked: Executive Order 14306 ("Sustaining Select Efforts to Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144," signed 6 June 2025) amends two *other* orders — EO 13694 and EO 14144, a later Biden-era order — and strikes one sentence from EO 14144 that referenced EO 14028, but does not itself rescind or amend EO 14028's text. However, OMB has substantially rolled back EO 14028's *implementing* memoranda: per OMB Memorandum M-26-05, "Adopting a Risk-Based Approach to Software and Hardware Security" (23 January 2026, per contemporaneous legal-alert reporting — this guide has not independently rendered the memo's own PDF text), OMB rescinded M-22-18 and its companion M-23-16, the memos that had made the Secure Software Development Attestation Form and a standardized SBOM/attestation process government-wide mandatory, replacing them with an agency-by-agency risk-based approach. The attestation form itself remains available for agencies that choose to keep using it; it is simply no longer mandatory government-wide. Readers should treat the legal-text-vs-OMB-implementation distinction as the key nuance here, not a single one-line "still in force" or "rescinded" answer.
In this cluster
