A software supply chain is the components, libraries, tools, and processes used to develop, build, and publish a software artifact. [1]
A software bill of materials (SBOM) declares the inventory of components used to build a software artifact, including any open source and proprietary software components. [2] [3] It is the software analogue to the traditional manufacturing BOM, which is used as part of supply chain management. [4]
An SBOM allows builders to make sure open-source and third-party software components are up to date and respond quickly to new vulnerabilities. [5] Buyers and other stakeholders can use an SBOM to perform vulnerability or license analysis, which can be used to evaluate and manage risk in a product. [6] [7] [8]
While many companies use a spreadsheet for general BOM management, there are additional risks and issues in an SBOM written to a spreadsheet. It is best practice for SBOMs to be collectively stored in a repository that can be part of other automation systems and easily queried by other applications.[ citation needed ]
Cybersecurity transparency studies, including TRACS 2025, identify the availability of SBOMs as one of the criteria used when purchasing information security solutions. [9] However, not all enterprise security products provide publicly available SBOMs. Research on open-source ecosystems indicates that policy-driven SBOMs remain rare in practice: one large-scale study found that only about 0.56 % of popular GitHub repositories contain SBOMs created in accordance with formal security or compliance policies. [10] Also, according to other research, fewer than half of tested software projects include SBOMs in their releases, and many of those SBOMs are incomplete or do not fully conform to established standards. [11] At the same time, corporate-level surveys report that approximately 60–76 % of enterprises require SBOMs from suppliers or have integrated SBOMs into procurement and supply-chain risk management processes. [12]
The Cyber Supply Chain Management and Transparency Act of 2014 [13] was a failed piece of US legislation (bill) that proposed to require government agencies to obtain SBOMs for any new products they purchase and to obtain SBOMs for "any software, firmware, or product in use by the United States Government". The act spurred later legislation such as "Internet of Things Cybersecurity Improvement Act of 2017." [14] [15]
US President Joe Biden’s Executive Order 14028 on Improving the Nation’s Cybersecurity of May 12, 2021 ordered NIST and NTIA to lay down guidelines for software supply chain management, including for SBOMs. [16] The NTIA outlines three broad categories of minimum elements of SBOMs: data fields (baseline information about each software component), automation support (the ability to generate SBOMs in machine- and human-readable formats), and practices and processes (how and when organizations should generate SBOMs). [17] The "automation support" requirement specifies the need for "automatic generation," which is possible with the use of Software Composition Analysis (SCA) solutions. [18]
{{cite journal}}: CS1 maint: article number as page number (link)