Seeking to help address software supply chain vulnerabilities, the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and international partners released a document Sept. 3 highlighting the benefits of software bills of materials (SBOMs) for both the private and public sectors.
CISA developed the report, “A Shared Vision of Software Bill of Materials for Cybersecurity,” alongside the National Security Agency and the agency’s counterparts from Australia, Canada, the Czech Republic, Slovakia, France, Germany, India, Italy, Japan, the Netherlands, Poland and South Korea. The organizations said their goal was to “inform producers, choosers (i.e. procuring organizations) and operators of software about the advantages of integrating SBOM generation, analysis and sharing into security processes and practices.”
Cybersecurity professionals, including within the ERO Enterprise, have increasingly promoted SBOMs as a solution to a major perceived weakness in modern software development. (See ReliabilityFirst Plugs SBOMs as Essential Cyber Tools.) Rather than being written from scratch, software products today often comprise multiple “components, modules and libraries from open source and proprietary” sources, the guide said. Transparency about these components and their origins is “fundamental for a more secure software ecosystem.”
This is the role of an SBOM, which CISA defined as “a formal record of the details and supply chain relationships of various components used in building software.” The document is similar in scope to a draft guide that CISA released for public comment Aug. 22. That document laid out minimum elements for SBOMs to be generated or requested by federal agencies. (See CISA Seeks Comments on New SBOM Guidance.)
The new guide also includes those elements, such as the expectation that SBOMs use a common format to ensure they are machine-processable, and “contain enough information about the open-source and proprietary components in the software to correlate with other data sources.”
Along with these, the document gives some of the benefits of SBOMs for organizations. CISA said the information provided in SBOMs can improve users’ vulnerability and supply chain management, software development processes and their license management.
To illustrate the potential improvements in vulnerability management, CISA pointed to Log4Shell, a vulnerability in the Log4j software library from Apache that was discovered in December 2021 to contain a weakness that remote actors could use to take control of affected systems.
“Because Log4j was usually used as a transitive dependency (a dependency of other dependencies), it was not always easy to identify,” CISA said. “Organizations without SBOM capability often had to engage in time-consuming manual searches and risked remaining vulnerable. Organizations with SBOMs were able to report a relatively straightforward and efficient response.”
Another illustration showed how the presence of an SBOM reduced average time needed for organizations to identify and respond to a vulnerability. Without an SBOM, CISA said, “each actor is dependent on upstream [software component] suppliers for notification that the vulnerability impacts their software.” But when everyone in the supply chain has an SBOM, organizations can determine for themselves if they are using a compromised product.
The benefits of SBOMs are not limited to producers and users, CISA said: National cybersecurity organizations such as CISA and its peers can also use their information to track their countries’ overall cyber vulnerability, issue warnings and update policymakers.
“The ever evolving cyber threats facing government and industry underscore the critical importance of securing [the] software supply chain and its components. Widespread adoption of [SBOMs] is an indispensable milestone in advancing secure-by-design software, fortifying resilience, and measurably reducing risk and cost,” acting CISA Director Madhu Gottumukkala said in a statement. “This guide exemplifies and underscores the power of international collaboration to deliver tangible outcomes that strengthen security and build trust.”



