Executive Order (EO) 14028 requires software publishers to submit a CISA Attestation Letter signed by the CEO for critical software by June 2024 & all software by September 2024.

GSA started collecting attestation letters from software publishers on June 8, 2024​

Are  you ready?​

Sell Better, Compliant Software ​

Compliance Requirements For SBOMs
U.S. Executive Order 14028
NIST 800-53r5
C-SCRM (NIST SP 800-161)
FedRAMP r5
SSDF (NIST SP 800-218)
Zero Trust Architecture (ZTA) (NIST SP 800-207)

Comprehensively meet Compliance Requirements with Confidence​​



"Lineaje is our technology partner, providing the SBOM360 Hub to our vendors to comply with EO14028 and deliver timely CISA attestation letters. Lineaje's comprehensive solution ensures our vendors meet compliance standards."

– Alex Whitworth, Director, Sales at Carahsoft Technology Corp


“Lineaje does an amazing job at ensuring our Software Bill of Materials (SBOMs) are compliant and helping us understand the risks our customers might identify. Lineaje’s SBOM360 Hub is a critical supply chain part for Veritas’ adherence to the Executive Order 14028 Compliance requirements. Their platform makes the private sharing of SBOMs with our customers effortless.”​

- Jax Jackson, ​Director, Product Security and Compliance Programs​ Product Security Group (PSG)​Veritas Technologies LLC

Pure Storage

"Lineaje SBOM360 Hub has revolutionized our management of SBOMs, ensuring compliance and providing a centralized, single-pane-of-glass view of software supply chain risks. It’s an invaluable tool for meeting EO14028 requirements and maintaining a secure, transparent software ecosystem."

- Sakthi Rangaraju, Product Security Incident Manager (PSIRT), PureStorgage​
SBOM NTIA Compliance Checker​

Upload an SBOM or let us create one for you​.

We check to ensure your SBOM meets the minimum NTIA requirements automatically​.

Our Unique Evidence Repository For Each SBOM​

CEO or designee must sign the Attestation Letter: Should you sign without evidence? Your SCA tools cannot provide any proof of assertions, but we can!

Auto-created Evidence Artifacts: We create and store comprehensive evidentiary artifacts in your very own evidence repository attesting provenance for each component to support your executive’s assertions.

Vulnerability Disclosure Report:​
Automate vulnerability disclosure with VEX / CSAF reporting.

Know what your customers can assess from your SBOM​

Transparent Risk Visibility: See the exact risks your customer will identify from your SBOM, ensuring no surprises and fostering trust.

Proactive Risk Management: ​Address and mitigate potential issues before your customer reviews them, enhancing your product's security profile.

Secure and Informed Sharing: ​Share your SBOM on a private, secure platform, facilitating clear and informed discussions about identified risks.


Automated Evidence Collection: ​Lineaje SBOM360 Hub collects and verifies all evidence automatically, ensuring that each attestation meets CISA requirements.​

SBOM and Proof of Compliance: ​Generates cryptographic hashes of build environments and infrastructure configurations, providing verifiable proof of compliance for each release and version tied to the SBOM.

Centralized Evidence Repo: ​
Maintains comprehensive records of SBOMs, evidence, and attestation forms, mapped to product SKUs allowing for easy verification and auditability of compliance.

Integrated with your SDLC​

Automated Mitigation Insights: ​Generate and Integrate VEX/CSAF to identify vulnerabilities that are not exploitable and tied to SBOMs.​

POAM Generation: ​Develops Plans of Action and Milestones (POAM) for areas where compliance is not immediately achievable.

Streamlined Management: ​Centralizes and automates vulnerability advisories, mitigations, and POAM tracking.

White Paper

EO14028 for Software Vendors White Paper​

Solution Brief

SBOM360 Hub Brief​

EO14028 Blogs