3 ms·

Say more about this SBOM regulation. Do you have an EN standard or something you can point me to?

• kevinherron 3y ago
  It's mostly a recommendation from what I've seen so far, but it's not hard to read this as a future requirement. CISA has been pushing it, which his my why it's on my radar: https://www.cisa.gov/sbom https://www.cisa.gov/sbom
  • Cerium 3y ago
    FDA wants electronic SBOM for future device approvals. https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs https://www.fda.gov/medical-devices/digital-health-center-ex...
• tapoxi 3y ago
  https://cyclonedx.org/ https://cyclonedx.org/
• lars_francke 3y ago
  As others have already commented: The US government has added SBOMs to a proposed rule to update the Federal Acquisition Regulation. So if you want to sell to the US Government you'll have to provide SBOMs: https://www.federalregister.gov/documents/2023/10/03/2023-21328/federal-acquisition-regulation-cyber-threat-and-incident-reporting-and-information-sharing https://www.federalregister.gov/documents/2023/10/03/2023-21... Lots of large companies require SBOMs from their supplier. In the EU we will get the Cyber Resilience Act which will make them mandatory as well in certain cases: https://data.consilium.europa.eu/doc/document/ST-12536-2023-INIT/en/pdf https://data.consilium.europa.eu/doc/document/ST-12536-2023-... And yes, there's bascially two technical standards to provide them: SPDX and CycloneDX: https://cyclonedx.org/ https://cyclonedx.org/