Definitive timeline: Federal guidance on software supply chain security

This report provides a concise timeline of U.S. federal actions to strengthen software supply chain security from 2021–2023, highlighting executive orders, SBOM requirements, NIST’s SSDF, ESF best-practice guides, OMB attestation mandates, CISA’s Secure by Design initiative, CI/CD defense guidance, SEC incident disclosure rules, FDA medical device cybersecurity guidance, CISA’s Software Identification Ecosystem work, and recommended practices for SBOM consumption. It contextualizes these efforts against rising software supply chain threats and underscores the shift toward producer accountability and standardized risk management across government and industry.