New executive order stops short of mandating NIST’s guidelines, but recommends SBOMs for federal agencies across government.