It does sound reasonable but will they invest in the resources to make this easier to those in the trenches. For example, I'm wondering why any DoD software would have the need to reach outside it's own internal repositories for it's dependencies. Repositories that have the adequate resources allocated to vet it's offerings for security vulnerabilities etc. Or are they going to make every Program Manager responsible for assuring their devs aren't reaching out to NPM or Maven Central?