Software Bill of Materials (SBOM)
What is Software Bill of Materials (SBOM)?
A comprehensive inventory of all components, libraries, and dependencies used in a software application. SBOMs enable organisations to identify and manage vulnerabilities in third-party and open-source software components.
Terms that appear alongside software bill of materials (sbom)
Each of these is named in at least one of the same controls as software bill of materials (sbom). The number is how many controls name both.
- software bill of materials 22 shared controls
- vulnerability 11 shared controls
- cybersecurity 10 shared controls
- audit 7 shared controls
- cisa 7 shared controls
- nist 6 shared controls
- supply chain risk 6 shared controls
- risk assessment 5 shared controls
Frameworks that govern software bill of materials (sbom)
What the standards actually require on software bill of materials (sbom)
Requirements naming software bill of materials (sbom) across 6 standards, quoted from the control text.
Article 54 establishes SUPPLY CHAIN CYBERSECURITY requirements for high-impact + critical-impact entities. Suppliers + service providers + software vendors providing components or services with cyber-physical-system implications must: (a) meet the Article 30 m...
NCCS-Art.54_55_56 · Supply chain cybersecurity (NCCS Articles 54-56) →ISMAP Cloud Infrastructure controls cover the underlying compute + network + storage + management plane. (1) Virtual Network Segmentation: VPC Virtual Private Cloud isolation + subnets + security groups + NACLs + microsegmentation + service mesh (Istio + Linke...
ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement · ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC →Disclose and operate audit logging + integrity assurance + cybersecurity risk management features per MDS2 AUDT + IGAU + CYBR sections.
MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring · MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring →Implement Asset Management + Identity and Access Management + Cryptography per MTCS SS 584. Asset Management (ISO 27001 Annex A.8 alignment) - asset inventory (hardware + software + data + virtual + container + serverless) + asset classification + asset owners...
MTCS-Asset-IAM-Cryptography-Multi-Tier-Asset-Inventory-RBAC-MFA-PAM-FIPS-HSM-Quantum-Safe · MTCS Asset Mgmt + IAM + Cryptography + Asset Inventory + RBAC + MFA + PAM + FIPS + HSM + Quantum-Safe →Vulnerability management + software assurance for aviation systems covers: (a) RTCA DO-178C 'Software Considerations in Airborne Systems' (the airworthiness software-assurance baseline - needs_licensed_copy);
FAA-CSA-VulnMgmt · Vulnerability Management and Software Assurance for Aviation Systems →Section 11.10(a) requires VALIDATION of closed systems to ensure accuracy + reliability + consistent intended performance + the ability to discern invalid or altered records.
Part11.CSV · Computer system validation + risk-based approach (21 CFR §11.10(a) + 2003 FDA Scope and Application Guidance + 2023 CSA draft) →Questions people ask about software bill of materials (sbom)
What is Software Bill of Materials (SBOM)?
Why is Software Bill of Materials (SBOM) important for compliance?
Which compliance frameworks address Software Bill of Materials (SBOM)?
Where can I learn more about Software Bill of Materials (SBOM)?
See how Software Bill of Materials (SBOM) applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.