1-888-310-4540 (main) / 1-888-707-6150 (support) info@spkaa.com
Select Page

SBOM Compliance: Navigating the Regulatory Landscape

windchill features best plm software
Written by Carlos Almeida
Published on January 18, 2024

Recent events, such as the Log4Shell / Log4J vulnerability, underscore the importance of best practices for cybersecurity in software development. And, with increasing cyber attacks, it’s more important than ever that organizations can pre-empt and respond to emerging threats. A key focal point for proactive cybersecurity management is the Software Bill of Materials (SBOM). SBOM has strategic implications for managing open-source software components within a product. Furthermore, in November 2023 there were developments under President Biden Executive Orders for Cybersecurity and Artificial Intelligence and National Cybersecurity Strategy. Let’s take a look at the latest things you need to know about SBOM compliance.

The Software Supply Chain And SBOM Compliance

Modern software development hinges on the integration of open-source libraries, turning the process into a collaborative effort involving a multitude of building blocks. Additionally, open-source components bring efficiency but also introduce challenges.

SBOM compliance

The Essence of Software Bill of Materials (SBOM)

A Software Bill of Materials (SBOM) is a solution in navigating the complexities of software supply chains. Essentially, an SBOM compliance provides a detailed inventory of all components and dependencies embedded within a software application. And, for organizations, this transparency is invaluable, offering insights into the intricate web of:

  • third-party modules,
  • libraries,
  • and frameworks that constitute the software.

Strategic Considerations for Open Source Software

As organizations contemplate their cybersecurity strategy, focusing on open-source software becomes paramount. While Log4Shell serves as a notable example, it merely scratches the surface of the broader challenge posed by the inclusion of open-source components. So, to effectively manage this aspect, adopting strategic considerations centered around SBOM compliance is essential.

SBOM compliance

Embracing SBOM for Proactive Compliance

  • Comprehensive Component Analysis: Leverage SBOM to conduct a thorough analysis of all components, identifying potential vulnerabilities and risks associated with open-source software.
  • Real-time Monitoring: Implement automated tools for continuous monitoring, ensuring that any emerging vulnerabilities in open-source libraries are promptly addressed.
  • Collaborative Vendor Engagement: Establish active collaboration with software vendors, staying informed about updates, patches, and security enhancements related to open-source components.
  • Educational Initiatives: Foster a culture of cybersecurity awareness among development teams, emphasizing the significance of scrutinizing and managing open-source software responsibly.
SBOM compliance

Navigating Compliance Challenges with SBOM

In the context of compliance challenges, SBOM becomes a linchpin for organizations aiming to adhere to industry standards and regulations. Basically, it offers a roadmap for demonstrating transparency and due diligence in managing the intricate web of open-source dependencies.

The 2023 Updates To The Biden Executive Order For SBOM Compliance

In November 2023, the Biden Executive Order received an update. Here’s what you need to know.

CISA’s Revised Draft Self-Attestation Common Form

Firstly, on November 16, 2023, CISA released a revised draft of the Common Secure Software Development Self-Attestation common form. Furthermore, this revision follows 110 comments received on the prior draft, incorporating changes responsive to industry feedback. While exemptions for “freely obtained and publicly available” software were added, the revision removes the provision allowing delegation of attestation. Organizations should stay vigilant as the final Common Form, anticipated in early 2024, may impact critical and non-critical software providers differently.

Best Practices for SBOM Consumption

Collaborating with industry partners in the “Enduring Security Framework,” CISA and the NSA published a cybersecurity technical report on November 9, 2023. Titled “Securing The Software Supply Chain: Recommended Practices for Software Bill of Materials Consumption,” the report offers valuable insights for SBOM consumers. Additionally, it emphasizes:

  • Operationalizing and scaling SBOM use.
  • Turning SBOMs into Risk Information.
  • Creating risk scores based on factors like Vulnerabilities, License, Community, and Dependencies.

FAR Council Extends Comment Period

Next, the FAR Council proposed two new FAR cybersecurity rules on October 3, 2023, addressing cyber threat reporting and standardizing cybersecurity requirements:

  • One clause will apply to contracts using cloud computing services.
  • One will apply to contracts using non-cloud computing (i.e., on-premises) services.

Furthermore, responding to industry concerns, the original 60-day comment period was extended until February 4, 2024. Federal contractors should stay informed and actively participate in the comment process to shape the impact of these regulations on their operations.

OMB’s Draft Guidance on AI Implementation

On November 1, 2023, the Office of Management and Budget (OMB) released draft guidance for agencies to implement the Artificial Intelligence (AI) Executive Order. The draft emphasizes:

  • Designating Chief AI Officers.
  • Removing barriers to responsible AI use.
  • Managing risk in federal AI procurement. 

Moreover, agencies are urged to prioritize AI in IT infrastructure and ensure cybersecurity processes align with AI applications.

CISA’s AI Roadmap

Lastly, CISA’s Artificial Intelligence roadmap, unveiled on November 14, 2023, outlines strategic efforts, including responsibly using AI for cyber defense and protecting critical infrastructure. Plus, within the roadmap, CISA commits to:

  • incorporating AI systems into its Secure By Design Initiative.
  • Evaluating SBOM toolchains.
  • Confirming AI software coverage in SBOM assessments.
SBOM compliance

At SPK we highly recommend utilizing tools like GitLab for managing DevSecOps. You can learn more about GitLab and why they were named a Leader twice in 2023 for their AI-powered DevSecOps platform.

SBOM Compliance Supports Cybersecurity Resilience

As organizations fortify their cybersecurity defenses, the strategic integration of SBOM emerges as a cornerstone. So, by embracing SBOM compliance practices, organizations not only enhance their understanding of the software supply chain but also proactively manage and mitigate risks associated with open-source software. While incidents like Log4Shell provide valuable lessons, the broader focus on SBOM empowers organizations to navigate the ever-evolving landscape of cybersecurity with resilience and compliance at its core.

If you need support with cybersecurity in your organization, our team of software cybersecurity experts can help. Contact us here for a no obligation discussion.

Latest White Papers

A Field Guide to Threat Vectors in the Software Supply Chain

A Field Guide to Threat Vectors in the Software Supply Chain

The software supply chain is made up of many integrated parts, people, and processes. The components range from tools and configurations to code libraries and systems. These components’ goals are developing and delivering software. Unfortunately, risks are high due to...

Related Resources

The Future of Data Engineering in 2024

The Future of Data Engineering in 2024

“Data engineering is the unsung hero of data science, the foundation upon which great data analysis is built.”Everyone in the computer science field is familiar with the phrase, “garbage in, garbage out.” This phrase encapsulates the importance of what goes on behind...

Adapt to Changing Markets to Emerge Stronger

Adapt to Changing Markets to Emerge Stronger

Adaptability is important for the success of organizations in the modern era.  Markets are continuously changing and the economy is constantly shifting.  Over the 20 plus years of SPK being in business, our goal has always been to help companies get their products to...

Why Businesses Must Embrace Digital Transformation

Why Businesses Must Embrace Digital Transformation

Hello and welcome to this SPK and Associates video, "Why Businesses Must Embrace Digital Transformation." My name is Michael Roberts, Vice President at SPK and Associates, and I'm here with Chris McHale, CEO and Co-founder of SPK and Associates. What is Digital...