Gary Hix, CTO of Public Sector, Shares Perspective on CISA’s Updated SBOM Guidance
CISA just released an update draft open to comments on the minimum elements of a Software Bill of Materials (SBOM) originally issued 2021. The draft reflects the learnings that industry and the government has experienced in the 4 years since the original guidance was issued. OMB introduced memorandum in 2022 around securing the software supply chain which provided additional motivation to agencies to adopt the SBOM as part of their standard practices. Prior to guidance from OMB, most agencies didn’t regularly request SBOMs from software and hardware producers.
These modifications to existing guidance are exactly what the government requires to adapt to an ever-changing software landscape. The recent focus by the current administration on speeding software procurement to take full advantage of innovations in the market increases the reliance on SBOMs to protect our software supply chain. New requirements further codify SBOMs to ensure they enhance automation, security, and usability across the government’s software estate. Security is clearly the priority, addressed by the requirement of software identifiers, component hashes and generation context, further providing insight into the software supply chain.
We can expect further guidance to continue to expand and mature. CISA is considering ways to expand SBOMs to reflect the larger software landscape that federal agencies are dealing with. Specific areas noted for future clarity are SaaS platforms and AI-based systems. Additionally, correlation of SBOMs with security advisories to identify vulnerabilities within an existing software environment are identified as another benefit of SBOMs. While not included in this draft, it’s clear that CISA is continuing to evaluate and evolve the government’s approach to the software supply chain to guarantee its security.
