EO 14306 removed CISA's central role in validating SSDF attestations. Vendors now hold their own audit-ready proof. What that means for your next federal RFP: https://anchore.com/blog/one-sbom-five-auditors/