Executive Order 14028 SBOM Requirements: What to Comply With and How | Endor Labs

What it is

A vendor explainer on Executive Order 14028 SBOM obligations after OMB M-26-05 (January 2026). Its useful parts are the NTIA field checklist, the memo lineage and a six-step program sequence. The rest is Endor Labs' own research figures, which the page presents without methodology.

What to do

Check any SBOM you produce or receive against the seven NTIA minimum data fields:

• Supplier name
• Component name
• Version
• Unique identifiers
• Dependency relationship
• SBOM author
• Timestamp

The page says NTIA's Minimum Elements (July 2021) have two further categories, automation support and practices and processes. Per the page, SPDX and CycloneDX both meet the data fields. SWID is also listed as recognized.

The page's suggested program order:

1. Generate SBOMs in CI in SPDX or CycloneDX.
2. Run SCA for a build-time inventory that includes transitive dependencies.
3. Store first- and third-party SBOMs centrally.
4. Add reachability and VEX context for triage.
5. Plan remediation with upgrade-impact analysis and backported patches.
6. Set policy for cadence, delivery method and ownership so the program is auditable.

Preconditions / Affected

• Directly bound: federal agencies and the vendors and integrators selling to them. New acquisitions carried these expectations from fiscal year 2023.
• Indirectly bound: the page says enterprise buyers copy federal language into their own contracts, so non-federal vendors get SBOM requests too.
• Memo history:
• OMB M-22-18 (2022) and M-23-16 (2023) required secure-development self-attestation on CISA's Common Form, with SBOMs as needed.
• M-26-05 rescinded the standardized attestation and moved to a risk-based approach.
• Agencies can still demand SBOMs by contract.
• The EO text itself remains in force.
• SSDF link: the order points to attestation under NIST SSDF (SP 800-218).
• Pending change: CISA proposed an update to the minimum elements in 2025. The page gives no detail.

Caveats

• The figures below are vendor claims, and the page gives no methodology for them:
• More than 95% of open source vulnerabilities sit in transitive dependencies.
• About 90.5% of vulnerabilities are unreachable at function level.
• Reachability plus EPSS cuts roughly 98% of noise.
• 95% of version upgrades contain a breaking change.
• Fixes need a major version bump about 24% of the time.
• Third-party figures cited:
• J.P. Morgan: 1.5–2% of reported vulnerabilities are exploited each year.
• Datadog: 87% of organizations have at least one known exploitable vulnerability in deployed services.
• Gamblin: 48,185 CVEs in 2025.
• The page says SBOMs vary by tool and lifecycle stage and are easy to get wrong. It does not say how to verify accuracy beyond using SCA.
• The closing sections promote Endor Labs products.