Software Bill of Materials
What is Software Bill of Materials?
A comprehensive inventory of all components, libraries, and dependencies used in a software application, supporting vulnerability management and supply chain security.
Terms that appear alongside software bill of materials
Each of these is named in at least one of the same controls as software bill of materials. The number is how many controls name both.
- software bill of materials sbom 22 shared controls
- vulnerability 14 shared controls
- cybersecurity 10 shared controls
- nist 9 shared controls
- supply chain risk 8 shared controls
- audit 8 shared controls
- risk assessment 7 shared controls
- cisa 7 shared controls
Frameworks that govern software bill of materials
What the standards actually require on software bill of materials
Requirements naming software bill of materials across 6 standards, quoted from the control text.
A software bill of materials is produced and made available to consumers of software.
ISM-1730 · Producing a software bill of materials →The SBOM lists every software component incorporated in the device for the HDO's operational security planning and supports the RDMP section;
mds2-medical-device::SBOM · SBOM Software bill of materials: disclose whether an SBOM exists, its format and fields, how to list installed components and how it is updated →Obtain and use a software bill of materials for acquired and produced software to support vulnerability management, licence compliance, and provenance tracking.
SCRM-COMP-2 · Software Bill of Materials Use →Produce a software bill of materials for each release in a machine readable format. Make it available to customers and use it internally to triage component vulnerabilities.
SP800-218-PS.3.2 · Software Bill of Materials →Build SBOM creation into development to give visibility of the software that goes into products; the guidance notes some authoring agencies are exploring other supply chain assurance approaches.
secure-by-design-a-guide-for-manufacturers-cisa::DT-8 · Software bill of materials (SSDF PS.3.2, PW.4.1) →Providing a purchaser a Software Bill of Materials for each product, directly or by publishing it on a public website; the SBOM is defined in sec.
us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(vii) · Sec. 4(e)(vii) Provide a Software Bill of Materials →Questions people ask about software bill of materials
What is Software Bill of Materials?
Why is Software Bill of Materials important for compliance?
Which compliance frameworks address Software Bill of Materials?
Where can I learn more about Software Bill of Materials?
See how Software Bill of Materials applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.