supply-chain-sbom.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Charter 1 1

1

2027-01-04T08:00:00 2027-02-03T17:00:00 2 2 X-G0 Program G0: Ready to Plan 1.1 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Steward (backup: executive sponsor; program) Owner or approver: Steward (backup: executive sponsor; program) If decided late: The questionnaire should land before it; its answers feed the program's planning Source: ../books/b14-compliance/appendix-b-product-inventory-questionnaire.md#why-the-questionnaire-comes-first 4 2027-01-29T17:00:00 3 3 S0.1 Charter drafted: pilot system, supply chain team, risk-acceptance owner, risk-based timelines 1.2 2 2027-01-04T08:00:00 2027-01-13T17:00:00 PT64H0M0S 7 0 CISO Owner or approver: CISO Source: ../books/b14-compliance/07-supply-chain-risk-management.md#who-owns-what 4 4 D-S1 Approve the supply chain charter and name the team (SR-2(1)) 1.3 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CIO Owner or approver: CIO Options: A dedicated supply chain program office; matrixed representatives from information security, procurement, risk management, engineering, software development, IT, legal and HR If decided late: Supplier records and reviews have no owner; Phase 1 waits Source: ../books/b14-compliance/10-who-owns-compliance.md#the-supply-chain-risk-lead 3 1 0 7 5 5 D-S2 Remediation timelines: risk-based or uniform 1.4 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Risk-based, from BOD 26-04's four questions (publicly exposed, in the KEV catalog, exploitation automatable, partial or total control); one uniform calendar for every finding If decided late: Intake can't set a deadline per finding; Phase 2 waits Source: ../books/b14-compliance/02-the-federal-clock.md#bod-26-04-risk-based-remediation 3 1 0 7 6 6 S0.2 Product inventory questionnaire completed: in use, product and offering, FedRAMP status, surface 1.5 2 2027-01-04T08:00:00 2027-01-15T17:00:00 PT80H0M0S 7 0 Program office Owner or approver: Program office Source: ../books/b14-compliance/appendix-b-product-inventory-questionnaire.md#how-to-complete-it 7 7 S0.3 Dated register of the federal dates the plan relies on, each with its source and last-checked day 1.6 2 2027-01-04T08:00:00 2027-01-06T17:00:00 PT24H0M0S 7 0 Program office Owner or approver: Program office Source: ../books/b14-compliance/02-the-federal-clock.md#how-the-program-keeps-the-clock 8 8 S0.4 Supply chain strategy (PM-30) drafted for annual review; senior procurement executive consulted 1.7 2 2027-01-14T08:00:00 2027-02-03T17:00:00 PT120H0M0S 7 0 CISO Owner or approver: CISO Source: ../books/b14-compliance/07-supply-chain-risk-management.md#who-owns-what 4 1 0 7 9 9 SG0 Gate 0 — Charter approved 1.8 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CIO Owner or approver: CIO Criteria: Pilot system chosen; supply chain team named; the authorizing official recorded as the owner of supply chain risk acceptance; risk-based timelines agreed Source: ../books/b14-compliance/07-supply-chain-risk-management.md#who-owns-what 4 1 0 7 5 1 0 7 10 10 Phase 1 — Inventory 2 1

1

2027-01-14T08:00:00 2027-02-05T17:00:00 11 11 D-S3 SBOM format the pipeline generates, and what intake accepts 2.1 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 Engineering teams that build and release software Owner or approver: Engineering teams that build and release software Options: SPDX 3.0 (ISO/IEC 5962:2021); CycloneDX 1.7 (ECMA-424); intake accepts any widely used format and normalizes it If decided late: The pipeline can't be built; the pilot SBOM waits Source: ../books/b14-compliance/07-supply-chain-risk-management.md#formats 9 1 0 7 12 12 S1.1 SBOM generated in CI for every pilot production release, with the CISA 2026 minimum elements 2.2 2 2027-01-14T08:00:00 2027-01-27T17:00:00 PT80H0M0S 7 0 Engineering teams Owner or approver: Engineering teams Source: ../books/b14-compliance/07-supply-chain-risk-management.md#what-an-sbom-must-contain 11 1 0 7 13 13 S1.2 Certification status per cloud service: FedRAMP ID, status, class, date checked; scope disposition 2.3 2 2027-01-18T08:00:00 2027-01-22T17:00:00 PT40H0M0S 7 0 Supply chain risk lead Owner or approver: Supply chain risk lead Source: ../books/b14-compliance/appendix-b-product-inventory-questionnaire.md#recording-fedramp-status 6 1 0 7 14 14 D-S4 A cloud service certified below the system's categorization 2.4 2 2027-01-22T17:00:00 2027-01-22T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Options: Decide the certification package supports this use, and record the decision; find an offering certified at the matching class If decided late: The flagged service can't pass the provisioning gate; its system's authorization waits Source: ../books/b14-compliance/appendix-b-product-inventory-questionnaire.md#the-scope-rule-for-cloud-dependencies 13 1 0 7 15 15 S1.3 Supplier record for every producer in the pilot SBOM and every in-boundary cloud service 2.5 2 2027-01-25T08:00:00 2027-02-05T17:00:00 PT80H0M0S 7 0 Supply chain risk lead Owner or approver: Supply chain risk lead Source: ../books/b14-compliance/07-supply-chain-risk-management.md#supplier-disclosure 12 3 14400 7 13 1 0 7 16 16 S1.4 Dated register re-verified at the program's G0 2.6 2 2027-02-01T08:00:00 2027-02-02T17:00:00 PT16H0M0S 7 0 Program office Owner or approver: Program office Source: ../books/b14-compliance/02-the-federal-clock.md#how-the-program-keeps-the-clock 2 1 0 7 7 1 0 7 17 17 SG1 Gate 1 — Pilot inventoried 2.7 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: SBOMs generated for the pilot's production releases; every supplier and cloud service recorded with its certification status and the date checked Source: ../books/b14-compliance/07-supply-chain-risk-management.md#who-owns-what 12 1 0 7 15 1 0 7 16 1 0 7 18 18 Phase 2 — Intake 3 1

1

2027-01-25T08:00:00 2027-02-19T17:00:00 19 19 S2.1 Vulnerability disclosure report produced from each pilot SBOM 3.1 2 2027-02-08T08:00:00 2027-02-12T17:00:00 PT40H0M0S 7 0 Engineering teams Owner or approver: Engineering teams Source: ../books/b14-compliance/07-supply-chain-risk-management.md#vulnerability-disclosure-report 17 1 0 7 20 20 S2.2 Reports joined to the KEV catalog; KEV components sent to the BOD 26-04 queue the same day 3.2 2 2027-02-15T08:00:00 2027-02-19T17:00:00 PT40H0M0S 7 0 Engineering teams Owner or approver: Engineering teams Source: ../books/b14-compliance/07-supply-chain-risk-management.md#exploitability-statements 19 1 0 7 5 1 0 7 21 21 S2.3 Supplier advisory feeds subscribed in machine-readable form where they exist 3.3 2 2027-02-08T08:00:00 2027-02-12T17:00:00 PT40H0M0S 7 0 Supply chain risk lead Owner or approver: Supply chain risk lead Source: ../books/b14-compliance/07-supply-chain-risk-management.md#supplier-disclosure 15 1 0 7 22 22 S2.4 Providers' vulnerability reports processed automatically into the same queue 3.4 2 2027-01-25T08:00:00 2027-01-29T17:00:00 PT40H0M0S 7 0 ISSO Owner or approver: ISSO Source: ../books/b14-compliance/07-supply-chain-risk-management.md#fedramp-what-binds-cloud-providers 13 1 0 7 23 23 SG2 Gate 2 — Intake working 3.5 2 2027-02-19T17:00:00 2027-02-19T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: SBOMs joined to the KEV catalog and the BOD 26-04 queue; supplier advisory feeds subscribed in machine-readable form where they exist; provider reports land in the same queue Source: ../books/b14-compliance/07-supply-chain-risk-management.md#who-owns-what 20 1 0 7 21 1 0 7 22 1 0 7 24 24 Phase 3 — Remediate and gate 4 1

1

2027-01-25T08:00:00 2027-03-12T17:00:00 25 25 D-S5 Exploitability of the pilot's first new vulnerability (VEX status) 4.1 2 2027-02-19T17:00:00 2027-02-19T17:00:00 PT0H0M0S 7 1 Owning application team, reviewed by security Owner or approver: Owning application team, reviewed by security Options: Not affected, with a justification; affected, with an action statement; fixed; under investigation If decided late: No signed statement; the finding can't move to remediation or closure Source: ../books/b14-compliance/07-supply-chain-risk-management.md#exploitability-statements 20 1 0 7 26 26 S3.1 One finding tracked to closure under its deadline, closed on re-test evidence 4.2 2 2027-02-22T08:00:00 2027-03-12T17:00:00 PT120H0M0S 7 0 System owner Owner or approver: System owner Source: ../books/b14-compliance/04-closure-with-proof.md#no-closure-counts-without-its-proof 25 1 0 7 23 1 0 7 27 27 D-S6 Supply chain risk carried on the pilot system 4.3 2 2027-02-19T17:00:00 2027-02-19T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Options: An open POA&M item with an owner, milestones and a deadline; a governed exception with an in-date acceptance and an expiry If decided late: A finding that misses its deadline has no disposition; Gate 3 waits Source: ../books/b14-compliance/10-who-owns-compliance.md#the-responsibility-matrix 25 1 0 7 28 28 S3.2 Provisioning gate on for new SaaS: Marketplace certification and the agency's authorization of the using system 4.4 2 2027-01-25T08:00:00 2027-01-29T17:00:00 PT40H0M0S 7 0 Supply chain risk lead Owner or approver: Supply chain risk lead Source: ../books/b14-compliance/07-supply-chain-risk-management.md#fedramp-what-binds-cloud-providers 13 1 0 7 14 1 0 7 29 29 S3.3 Each provider's VDR and VER status checked after FedRAMP's corrective-action window closes 4.5 2 2027-03-08T08:00:00 2027-03-10T17:00:00 PT24H0M0S 7 0 ISSO Owner or approver: ISSO Source: ../books/b14-compliance/02-the-federal-clock.md#the-dates-still-ahead 6 3 216000 7 22 1 0 7 30 30 X-G1 Program G1: Foundation Complete 4.6 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Steward (program) Owner or approver: Steward (program) If decided late: The register's G1 re-verification moves with it Source: ../books/b14-compliance/02-the-federal-clock.md#how-the-program-keeps-the-clock 4 2027-02-26T17:00:00 31 31 S3.4 Dated register re-verified at the program's G1 4.7 2 2027-03-01T08:00:00 2027-03-02T17:00:00 PT16H0M0S 7 0 Program office Owner or approver: Program office Source: ../books/b14-compliance/02-the-federal-clock.md#how-the-program-keeps-the-clock 30 1 0 7 16 1 0 7 32 32 SG3 Gate 3 — Remediation and the provisioning gate proven 4.8 2 2027-03-12T17:00:00 2027-03-12T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: At least one finding tracked to closure on its risk-based deadline, with re-test evidence; new SaaS provisioning gated on a recorded status for the pilot Source: ../books/b14-compliance/07-supply-chain-risk-management.md#who-owns-what 26 1 0 7 27 1 0 7 28 1 0 7 29 1 0 7 31 1 0 7 33 33 Phase 4 — Evidence 5 1

1

2027-01-28T08:00:00 2027-03-19T17:00:00 34 34 X-CM1 Evidence contract published 5.1 2 2027-01-27T17:00:00 2027-01-27T17:00:00 PT0H0M0S 7 1 CISO (Continuous Monitoring & Evidence Fabric plan) Owner or approver: CISO (Continuous Monitoring & Evidence Fabric plan) If decided late: Supply chain records have no contract to emit to Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 4 2027-01-27T17:00:00 35 35 S4.1 SBOMs, reports and VEX statements signed, stored immutably and emitted in the contract's shape 5.2 2 2027-02-22T08:00:00 2027-02-26T17:00:00 PT40H0M0S 7 0 Engineering teams Owner or approver: Engineering teams Source: ../books/b14-compliance/07-supply-chain-risk-management.md#the-evidence-pipeline 23 1 0 7 34 1 0 7 25 1 0 7 36 36 S4.2 Pilot release workflow at SLSA Build L2 5.3 2 2027-01-28T08:00:00 2027-02-03T17:00:00 PT40H0M0S 7 0 Engineering teams Owner or approver: Engineering teams Source: ../books/b14-compliance/07-supply-chain-risk-management.md#build-provenance 12 1 0 7 37 37 S4.3 Build L3 through shared reusable workflows; two-party review on protected branches 5.4 2 2027-02-04T08:00:00 2027-02-17T17:00:00 PT80H0M0S 7 0 Engineering teams Owner or approver: Engineering teams Source: ../books/b14-compliance/07-supply-chain-risk-management.md#build-provenance 36 1 0 7 38 38 D-S7 Which clauses each acquisition carries 5.5 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 Contracting officer, advised by the supply chain team Owner or approver: Contracting officer, advised by the supply chain team Options: An SBOM on request; for a cloud platform, an SBOM of the runtime production environment; a supplier notification agreement (SR-8); the secure-development attestation form; utilization and pricing disclosure (M-26-10) If decided late: The next acquisitions go out without them; SR-5 and SR-8 stay open Source: ../books/b14-compliance/07-supply-chain-risk-management.md#the-closure-record 15 1 0 7 39 39 S4.4 Clauses written into the next acquisitions 5.6 2 2027-02-08T08:00:00 2027-03-12T17:00:00 PT200H0M0S 7 0 Contracting officer Owner or approver: Contracting officer Source: ../books/b14-compliance/07-supply-chain-risk-management.md#supplier-disclosure 38 1 0 7 40 40 X-CM4 Package artifacts generated from the stream 5.7 2 2027-03-08T17:00:00 2027-03-08T17:00:00 PT0H0M0S 7 1 CISO (Continuous Monitoring & Evidence Fabric plan) Owner or approver: CISO (Continuous Monitoring & Evidence Fabric plan) If decided late: Supply chain findings can't appear in a generated POA&M; Gate 4 waits Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 4 2027-03-08T17:00:00 41 41 S4.5 Pilot findings in the generated POA&M; a closure record per SR control naming what closes it 5.8 2 2027-03-15T08:00:00 2027-03-19T17:00:00 PT40H0M0S 7 0 ISSO Owner or approver: ISSO Source: ../books/b14-compliance/07-supply-chain-risk-management.md#the-closure-record 35 1 0 7 26 1 0 7 40 1 0 7 42 42 SG4 Gate 4 — Evidence in the stream 5.9 2 2027-03-19T17:00:00 2027-03-19T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: SBOMs, reports and statements signed and stored; Build L2 reached, then L3; contract clauses in the next acquisitions; residual supply chain risk owned by the authorizing official Source: ../books/b14-compliance/07-supply-chain-risk-management.md#who-owns-what 37 1 0 7 39 1 0 7 41 1 0 7 8 1 0 7 32 1 0 7