Prepare for EO 14028 software supply chain demands with confidence

Executive Order 14028, Improving the Nation's Cybersecurity, is a US presidential order signed on 12 May 2021. It directs federal agencies to adopt zero trust architecture, multi-factor authentication and encryption, improve threat information sharing, logging and incident response, create a Cyber Safety Review Board and raise software supply chain security standards for the software the government buys.

EO 14028 binds US federal executive agencies directly. It reaches private companies indirectly: software producers, cloud providers and IT service providers that sell to the federal government may be asked through contracts, procurement terms or agency assurance requests to show secure development practices, provide SBOMs, report incidents and share logs. Companies with no federal customers are not directly covered.

Section 4(e) directed NIST to issue guidance on software supply chain security covering ten areas: secure development environments, artefacts showing conformance, automated tools for trusted source code, vulnerability checking and remediation, sharing tool artefacts, provenance controls on components, a Software Bill of Materials, a vulnerability disclosure programme, attestation to secure practices and the integrity of open source components.

Not as a blanket requirement. OMB memo M-26-05, issued in January 2026, rescinded M-22-18 and M-23-16, which had required agencies to collect the common self-attestation form. Agencies now set risk-based software assurance policies and may still ask a supplier for a self-attestation or an SBOM where they judge it necessary, so suppliers should be ready to provide them.

The order itself sets no fines on private companies. The consequences for suppliers are commercial and contractual: agencies may decline to use software without adequate assurance, and contract terms derived from the order can be enforced. Knowingly false statements to the government about security practices can also create legal liability, so any attestation should be backed by evidence.

EO 14028 led NIST to publish the Secure Software Development Framework, SP 800-218, which is the practical benchmark for its secure development expectations. ISO 27001 and SOC 2 overlap with many of the access control, logging, encryption and vulnerability management practices, so evidence gathered for them can support EO 14028 requests, but neither covers SBOMs or software provenance in full.

It depends on how mature your development and security practices already are. A team that already holds ISO 27001 or SOC 2 and runs controlled build pipelines mainly needs to document secure development practices, produce SBOMs and set up a vulnerability disclosure process. Teams starting from scratch will need longer to establish and evidence those controls.

Yes, on request. EO 14028 is mapped in OneClickComply's control library but is not yet a live framework in the product, so contact us to enable it. Once enabled, its practices map to the controls you already run for frameworks like ISO 27001 and SOC 2, with automated evidence collection, policy generation and questionnaire automation helping you answer federal assurance requests.