A long history: What’s next for software bills of materials is what matters

Software bills of materials (SBOMs) are having their day — they're even government-mandated at times. In September 2023, the U.S. Food and Drug Administration issued its final version of “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.” The guidance corresponds to the 2023 Consolidated Appropriations Act, H.R. 2617 (PDF), which calls on the FDA to acquire attestations, including an SBOM, from medical device manufacturers regarding their products’ cybersecurity.

While SBOMs are currently mandated by the government only in the medical area, broader industry consensus is growing in favor of SBOMs. In October 2023, analyst firm Gartner released a report, “Mitigate Enterprise Software Supply Chain Risks,” which stated that “the inability or unwillingness of a vendor to provide an SBOM should be viewed as a significant risk and potentially disqualifying.”

Still, security leaders and risk managers are just getting used to the idea of creating SBOMs. To help put them into context, Beau Woods, founder and CEO of Stratigos Security, joined a ConversingLabs conversation with Paul Roberts to explore the history of the SBOM, from its humble beginnings to its modern-day use. Most important for helping you weigh whether SBOMs are right for your organization, Woods discusses efforts to adapt them for the future. Here are key highlights from the ConversingLabs episode.

The SBOM: Trending, but not new

Woods first came across the concept of the SBOM in 2013 when he began working with I Am the Cavalry, a grass-roots organization focused on driving cybersecurity for improved public safety and human life. But, as Woods noted to Roberts, the SBOM didn’t start there: