A software supply chain encompasses the components, libraries, and processes used to build software, and a software bill of materials (SBOM) serves as its formal inventory, improving transparency and enabling vulnerability analysis. High-profile attacks like the SolarWinds incident demonstrate how compromising an upstream component can cascade to all downstream users, while provenance frameworks like in-toto help verify a release's origin and build process to detect tampering. Despite their benefits, adoption is sparse—only about 0.56% of popular GitHub repositories contain policy-driven SBOMs, and generation tools often produce inaccurate, bloated dependency lists. Legislative efforts began with the failed Cyber Supply Chain Management and Transparency Act of 2014, but gained momentum with President Joe Biden's Executive Order 14028 (May 12, 2021), which directed NIST and NTIA to create SBOM guidelines. Corporate surveys indicate that 60–76% of enterprises now require SBOMs from suppliers, yet many released SBOMs remain incomplete or non-conformant to standards. Overall, SBOMs are a critical but still maturing strategy for securing the software ecosystem, bridging the gap between policy intent and practical implementation.