1.2 Scope and Context

This technical advisory is intended for guidance purposes only. The recommendations and best practices described herein are non-mandatory and do not create or modify any legal, regulatory, or compliance obligations.

The scope of this technical advisory is limited to Software Bill of Materials and does not cover other emerging Bill of Materials (BOM), such as Software Bill of Materials for AI, Hardware Bill of Materials (HBOM), Cryptographic Bill of Materials (CBOM) or other variants. While all artifacts may share some common principles, they also have differentiators and therefore are considered out of scope for this advisory.

This technical advisory remains sector-agnostic and applicable across all types of organisations regardless of their operational environment or industry. It is primarily focused on organisations that are at the early stage of SBOM adoption, and it does not provide a framework for assessing and improving organisational maturity. Future editions may cover the topic more extensively.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.