|
Modern software products contain hundreds or thousands of components, each potentially harbouring vulnerabilities that threaten application and operating system security. Without component visibility, organisations operate blindly, discovering exposures only after exploitation occurs. The Software Bill of Materials (SBOM) supports proactive vulnerability tracking by identifying components with potential vulnerabilities, allowing security teams to correlate component inventories against publicly disclosed security vulnerabilities and respond to emerging risks. Beyond immediate vulnerabilities, SBOM data supports the assessment of component viability and supply chain sustainability risks. An SBOM is a formal record containing details and supply chain relationships of components included in the software elements of a product with digital elements. The SBOM should be drawn in a commonly used and machine-readable format identifying and documenting components contained in the products with digital elements. It can provide those who manufacture, purchase, and operate software with information that enhances their understanding of the supply chain, which has multiple benefits, in particular it helps manufacturers and users to track known newly emerged vulnerabilities and cybersecurity risks (1). Core Capabilities - Transparency . Reveals third-party and open-source components comprising modern software.
- Traceability . Links deployed software to upstream suppliers and downstream consumers.
- Compliance . Provides auditable records for regulatory and contractual requirements.
- Security . Supports vulnerability detection and software provenance verification.
SBOMs form a foundational data layer rather than a complete security solution. Their value emerges through integration with security processes such as timely patching, mitigation activities, and documented vulnerability handling decisions, with continuous maintenance, and systematic deployment across the software development lifecycle (SDLC). This document provides practical guidance on the adoption of SBOM, and it is intended for organizations especially micro-, small and medium enterprises (SMEs) and stewards seeking to set up the initial capabilities to enhance the software supply chain transparency. It aligns with the security principles from the ENISA Secure by Design and Default Playbook (2), particularly supply chain controls, lifecycle management, and secure coding and verification practices. It introduces key concepts, industry standards, use cases and implementation practices to support organisations initiating their SBOM journey. In particular, this document: - outlines the SBOM implementation architecture and data flows based on a defined lifecycle;
- presents an indicative SBOM threat model along with targeted risks;
- lists measures to address the security issues across the SBOM ecosystem.
This technical advisory considers regulatory requirements such as those set out in the Cyber Resilience Act (CRA) (3), in particular essential requirements related to SBOM obligations for manufacturers but essentially describes recommended best practices that may go beyond those requirements. It aims to provide technical context to such requirements by describing common threats across the SBOM lifecycle along with practical recommendations to mitigate them. However, this document should not be considered as a legal interpretation of the CRA.
|