+4. SBOM Best Practices
---+4.1 SBOM Integration and Automation
------+4.1.1 Integration Patterns
------+4.1.2 Common Configuration Requirements
---+4.2 General Security Recommendations

4. SBOM Best Practices

This section presents indicative best practices for secure SBOM integration and automation based on the defined SBOM lifecycle while also complementing the suggested mitigation activities for the identified threats and general risks presented in the previous section.

1. Översikt

4.1 SBOM Integration and Automation

For a minimum viable implementation, begin with build-time integration as the foundation. This approach captures dependencies when they are most accurately known and requires minimal infrastructure changes.

Leverage existing continuous integration infrastructure by adding SBOM generation as a pipeline stage. Utilise command-line interfaces compatible with current build environments and store generated SBOMs alongside build artifacts using existing artifact repositories. Finally, implement validation through standard pipeline testing mechanisms. (Figure 3)

Figure 3 - Pipeline Integration

4.2 General Security Recommendations

Security controls should be applied end-to-end across the SBOM CI/CD pipeline to protect the main principles of confidentiality, integrity, availability, authenticity and non-repudiation. Table 7 presents indicative security controls to be taken into consideration when building the CI/CD pipelines and their purpose.

	Lifecycle Phase		Security control	Purpose
All Phases		Role-based Access Control (RBAC)		Restrict access to repositories, CI/CD

workflows, signing service and SBOM

repositories based on least privilege.

Multi-factor Authentication (MFA)	Protect developer, administrator and CI/CD platform accounts from credential compromise.
Least Privilege		Minimize permissions to users, service

accounts and automation.

Secure Transport Layer	Protect communications between pipeline components using TLS 1.3 with certificate validation.
Audit Logging		Record all pipeline activities, including

generation, validation, signing events etc.

	Security Event Alerting	Generate alerts for failed validations, signature failures and unauthorized access.
	Pipeline Integrity Protection	Protect CI/CD workflows from unauthorized modification through code review and branch protection.
	Configuration Management	Maintain version-controlled and approved configurations for pipeline components and security policies.
	Tool stack verification	Verify the integrity and provenance of SBOM generators, validators and supporting tools before execution.
Generation	Trusted repositories	Retrieve dependencies only from authenticated and trusted registries or mirrors.

		Provenance Generation		Generate verifiable build provenance linking source, build process, SBOM and software artifact.
	Validation, Signing,		Secure Secrets		Store signing keys, API tokens and repository
	Store		Management		credentials in secure vaults where applicable.
Signing, Store		Artifact Binding			Cryptographically associate the SBOM with

the software artifact it describes.

Store	Tamper-Evident Storage		Store SBOMs and artifacts in immutable or version-controlled repositories with integrity protection.
		Repository Integrity		Detect unauthorized changes to source code,
		Monitoring		artifacts or SBOM repositories.
Store, Maintenance & Update	Version control			Maintain version history of software artifacts

and associated SBOMs.

Backup and Recovery

Ensure SBOM repositories, signing material

and audit logs can be recovered.

Table 7 - Security Recommendations

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

Krav
Källa	Krav

3. Relaterade regleringar

Regleringar
Källa	Reglering

ENISA -