The EO is a good start, but it’s not enough.

The next step should be to expand the scope of SBOMs and ATOs to include APIs as well as other types of computing activities such as cloud services, virtual machines (VMs), containers, and IoT devices
https://t.co/90EXmPAS1A