[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsn64Sp3hasRpOey2hjpSsDZawyYWFwoN_GTMV4oWRoI":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"196654a4-ca2d-4ccf-826f-b2ad78cf1bee","Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains","trump-orders-defense-contractors-to-map-software-suppliers-across-critical-suppl-d2d6fb","New executive order calls for end-to-end visibility into defense supply chains, including software dependencies, foreign ownership and cyber-related supplier risks. The post Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains appeared first on SecurityWeek.","President Trump has signed an executive order requiring defense contractors to map their entire supply chains, including software dependencies, foreign ownership, and cyber risks. This initiative aims to enhance visibility and security within national security systems by demanding detailed 'indentured Bills of Materials' and proactive supplier vetting.","US defense contractors must map software and suppliers across critical supply chains.","https:\u002F\u002Fwww.securityweek.com\u002Ftrump-orders-defense-contractors-to-map-software-suppliers-across-critical-supply-chains\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F02\u002FWhite-House-Cybersecurity.jpg","2026-07-21T18:16:09+00:00","2026-07-21T20:00:07.133864+00:00",7,[17,20,23],{"name":18,"type":19},"Bill of Materials","product",{"name":21,"type":22},"software supply chain security","technology",{"name":24,"type":22},"third-party risk","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":51,"vendors":136},[52,80,109],{"slug":53,"name":54,"problem":55,"products":56},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":75,"url":78,"description":79},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":81,"name":82,"problem":83,"products":84},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"slug":110,"name":111,"problem":112,"products":113},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":132,"url":134,"description":135},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":151},"trump-eo-mandates-defense-contractor-supply-chain-mapping","Trump EO Mandates Defense Contractor Supply Chain Mapping","The executive order highlights a long-standing gap in national security posture: defense contractors and critical infrastructure operators have lacked comprehensive visibility into their own software dependencies, foreign supplier relationships, and inherited cyber risks. Without structured Bills of Materials (both software and hardware), organizations cannot identify where adversarial nation-state actors or compromised components may be embedded deep within supply chains. High-profile incidents like SolarWinds demonstrated that a single trusted supplier can become a vector compromising thousands of downstream organizations. Regulatory mandates like this one matter because voluntary efforts have proven insufficient — formal accountability frameworks force organizations to surface risks they might otherwise overlook or deprioritize.",[142,143,144,145,146,147,148,149,150],"NIST SP 800-161r1 – Cybersecurity Supply Chain Risk Management (C-SCRM)","NIST SP 800-218 – Secure Software Development Framework (SSDF)","CIS Control 2 – Inventory and Control of Software Assets","CIS Control 15 – Service Provider Management","NIST CSF 2.0 – GV.SC (Cybersecurity Supply Chain Risk Management)","Executive Order 14028 – Improving the Nation's Cybersecurity (SBOM requirements)","DFARS 252.204-7012 – Safeguarding Covered Defense Information","ISO\u002FIEC 27036 – Information Security for Supplier Relationships","CMMC 2.0 – Level 2\u002F3 Supply Chain Risk Practice Areas",{}]