They're doing it because the Executive Order requires it if you want to sell software to the US Federal Government. By default, what the USG demands becomes a

They're doing it because the Executive Order requires it if you want to sell software to the US Federal Government. By default, what the USG demands becomes a more general thing, as other governments and levels of government adopt the same standards. Then vendors will produce it and it will become a condition of commerical contracts. The vendor is already liable (or should be) for knowing what's in the product they've supplied. This is just a way of documenting it in a standard way.