No, I didn't get it on paper. I can roughly date it: the prohibition against using any SuperMicro hardware must have been around 2014 or 2015. Our department (working in one of the very large computer companies in the US) had bought some SuperMicro servers (because they had particularly good disk enclosures), and about half a year or a year later, around 2014-2015 we got an edict from internal security that they are to be taken offline, and shredded.
The ban on Kaspersky virus scanners happened later; it seems plausible that it was 2017, as Phishfry reports. We had been using a different virus scanner on Windows anyway (I was using a Mac laptop as my daily driver, still had a Windows laptop too, and all our machines were centrally managed and configured), but at some point another edict came down that absolutely no Kasperksy software is allowed to be purchased, installed, or used in house.
In both cases, it was clear from context that this was coming not just from our internal computer security people, but from the federal government, which was one of our larger customers. Clearly, they wouldn't divulge which agency said so.
They have to schedule appointments with subject matter experts (whose job it is to explain), and to splash enough money to make the explanations even happen. Hard facts can be surprisingly difficult to come by, even if they are public information. This is why basic education and critical thinking are so important.
