Name: Software Supply Chain Security: SSDF, Attestations and SBOMs Course (Self-Paced)
Price: 799.0 USD
Availability: InStock

This course includes

6 hours of project-based training from experts
Answers from real instructors
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 0.6 CPEs and 0.6 CEUs

The SolarWinds Orion compromise showed how one trusted software update can reach thousands of organizations. This foundational course explains the software supply chain security pieces set in motion by Executive Order 14028, with no technical background required.

Learners study the NIST Secure Software Development Framework, the self-attestations that software producers provide to agencies, and software bills of materials. The focus is on what attestations and SBOMs do and do not guarantee, so learners can evaluate vendor submissions with confidence.

Tuition

Full Tuition

$799
Due before the class starts

This course includes

6 hours of project-based training from experts
Answers from real instructors
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 0.6 CPEs and 0.6 CEUs

Learning Experience Highlights

Training from government‑experienced instructors

Receive instruction from subject‑matter experts who bring proven government experience.

Specialized for government & DoD

Courses that are regularly updated based on feedback and industry developments, ensuring versions are mapped to federal competencies.

The instructor was wonderful and so knowledgeable. The course materials were extremely relevant to what my job is. I feel like I can be better because of this class.
— 2025 student

Three professionals sit in black chairs with laptops and notebooks, engaged in conversation against a red wall.

Real-world solutions

Directly addressing the day-to-day challenges of federal employees.

125+ departments & agencies served

Your trusted training partner, equipping public service professionals with the skills and knowledge to excel in their roles and drive meaningful impact.

100% Online. Start Anytime

24/7 access to our premium course videos and projects.
Industry experts are assigned as your course instructor. Message your instructor with any questions.
Participate in GSUSA online discussion forums — share ideas and receive additional support.
Hands-on quizzes and mini projects to test and reinforce concepts.

Earn a Certificate of Completion

Upon completion of this course, you’ll receive an official certificate testifying to your mastery of the curriculum. We’ll send you a link where you can download your certificate, share it online with your friends, post it to your professional network on LinkedIn, and view all your earned certificates. Congratulations on your achievement!

Shareable on

Sample credential for completion of Software Supply Chain Security: SSDF, Attestations and SBOMs Course (Self-Paced)

A group of adult learners sits in a classroom, smiling and engaged in a government training session.

A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.

A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Software Supply Chain Security: SSDF, Attestations and SBOMs Course (Self-Paced) Curriculum

What You'll Learn at a Glance

Identify the components that make up a typical software supply chain.
Explain why a compromise in an upstream software component can affect every agency that uses it.
Describe what Executive Order 14028 directed federal agencies and software producers to do.
Identify the four practice groups in the NIST Secure Software Development Framework.
Explain why the SSDF describes outcomes rather than prescribing specific tools or techniques.
Explain what a software producer's self-attestation requires them to certify.
Identify who is expected to sign a self-attestation on behalf of a software producer.
Describe what an agency does with a self-attestation once it is received.
Recognize when an attestation alone is not enough and supporting artifacts are required.
Identify the core elements typically found in a software bill of materials.
Read a simple SBOM to locate a specific software component and its version.
Explain why having an SBOM helps an agency respond faster to a newly disclosed vulnerability.
Identify a limitation of relying on an SBOM alone.

Course Syllabus

Download Syllabus PDF

Module 1: Why Software Supply Chain Security Became a Federal Priority

Lessons:
- What a Software Supply Chain Actually Includes
- How a Compromise Upstream Becomes an Agency's Problem
- Executive Order 14028 and the Federal Response
Applied activity: Learners review a short, described scenario in which a widely used software update is later found to contain malicious code and trace which of the agency's own systems would be affected and why.

Module 2: The Secure Software Development Framework (SSDF)

Lessons:
- What the SSDF Is and Who It Is For
- The Four SSDF Practice Groups
- How the SSDF Differs From a Compliance Checklist
- Reading an SSDF Practice: An Example Walkthrough
Applied activity: Learners review a short, described SSDF practice statement and identify what a software producer would need to do, and what evidence they might produce, to demonstrate they follow it.

Module 3: Self-Attestation: What Agencies Require From Software Producers

Lessons:
- The Self-Attestation Requirement, and What It Actually Asks For
- Who Signs an Attestation, and What They Are Certifying
- What an Agency Does With an Attestation Once Received
- When an Attestation Is Not Enough: Artifacts and Extensions
Applied activity: Learners review a short, described attestation submission and identify whether it meets the basic requirements, then decide what an agency's next step should be if it does not.

Module 4: Software Bills of Materials (SBOMs): What They Are and How Agencies Use Them

Lessons:
- What an SBOM Actually Contains
- Reading a Simple SBOM Example
- Why Agencies Ask for SBOMs
- Common SBOM Formats and Limitations
Applied activity: Learners review a simplified, described SBOM listing several components and identify which one would need immediate attention if a newly disclosed vulnerability affected a specific component and version.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts

Installments
	10% non-refundable deposit
$799.00	Total You Pay