fbpx
1-888-310-4540 (main) / 1-888-707-6150 (support) info@spkaa.com
Select Page

SBOM Compliance: Navigating the Regulatory Landscape

windchill features best plm software
Written by Carlos Almeida
Published on January 18, 2024

Recent events, such as the Log4Shell / Log4J vulnerability, underscore the importance of best practices for cybersecurity in software development. And, with increasing cyber attacks, it’s more important than ever that organizations can pre-empt and respond to emerging threats. A key focal point for proactive cybersecurity management is the Software Bill of Materials (SBOM). SBOM has strategic implications for managing open-source software components within a product. Furthermore, in November 2023 there were developments under President Biden Executive Orders for Cybersecurity and Artificial Intelligence and National Cybersecurity Strategy. Let’s take a look at the latest things you need to know about SBOM compliance.

The Software Supply Chain And SBOM Compliance

Modern software development hinges on the integration of open-source libraries, turning the process into a collaborative effort involving a multitude of building blocks. Additionally, open-source components bring efficiency but also introduce challenges.

SBOM compliance

The Essence of Software Bill of Materials (SBOM)

A Software Bill of Materials (SBOM) is a solution in navigating the complexities of software supply chains. Essentially, an SBOM compliance provides a detailed inventory of all components and dependencies embedded within a software application. And, for organizations, this transparency is invaluable, offering insights into the intricate web of:

  • third-party modules,
  • libraries,
  • and frameworks that constitute the software.

Strategic Considerations for Open Source Software

As organizations contemplate their cybersecurity strategy, focusing on open-source software becomes paramount. While Log4Shell serves as a notable example, it merely scratches the surface of the broader challenge posed by the inclusion of open-source components. So, to effectively manage this aspect, adopting strategic considerations centered around SBOM compliance is essential.

SBOM compliance

Embracing SBOM for Proactive Compliance

  • Comprehensive Component Analysis: Leverage SBOM to conduct a thorough analysis of all components, identifying potential vulnerabilities and risks associated with open-source software.
  • Real-time Monitoring: Implement automated tools for continuous monitoring, ensuring that any emerging vulnerabilities in open-source libraries are promptly addressed.
  • Collaborative Vendor Engagement: Establish active collaboration with software vendors, staying informed about updates, patches, and security enhancements related to open-source components.
  • Educational Initiatives: Foster a culture of cybersecurity awareness among development teams, emphasizing the significance of scrutinizing and managing open-source software responsibly.
SBOM compliance

Navigating Compliance Challenges with SBOM

In the context of compliance challenges, SBOM becomes a linchpin for organizations aiming to adhere to industry standards and regulations. Basically, it offers a roadmap for demonstrating transparency and due diligence in managing the intricate web of open-source dependencies.

The 2023 Updates To The Biden Executive Order For SBOM Compliance

In November 2023, the Biden Executive Order received an update. Here’s what you need to know.

CISA’s Revised Draft Self-Attestation Common Form

Firstly, on November 16, 2023, CISA released a revised draft of the Common Secure Software Development Self-Attestation common form. Furthermore, this revision follows 110 comments received on the prior draft, incorporating changes responsive to industry feedback. While exemptions for “freely obtained and publicly available” software were added, the revision removes the provision allowing delegation of attestation. Organizations should stay vigilant as the final Common Form, anticipated in early 2024, may impact critical and non-critical software providers differently.

Best Practices for SBOM Consumption

Collaborating with industry partners in the “Enduring Security Framework,” CISA and the NSA published a cybersecurity technical report on November 9, 2023. Titled “Securing The Software Supply Chain: Recommended Practices for Software Bill of Materials Consumption,” the report offers valuable insights for SBOM consumers. Additionally, it emphasizes:

  • Operationalizing and scaling SBOM use.
  • Turning SBOMs into Risk Information.
  • Creating risk scores based on factors like Vulnerabilities, License, Community, and Dependencies.

FAR Council Extends Comment Period

Next, the FAR Council proposed two new FAR cybersecurity rules on October 3, 2023, addressing cyber threat reporting and standardizing cybersecurity requirements:

  • One clause will apply to contracts using cloud computing services.
  • One will apply to contracts using non-cloud computing (i.e., on-premises) services.

Furthermore, responding to industry concerns, the original 60-day comment period was extended until February 4, 2024. Federal contractors should stay informed and actively participate in the comment process to shape the impact of these regulations on their operations.

OMB’s Draft Guidance on AI Implementation

On November 1, 2023, the Office of Management and Budget (OMB) released draft guidance for agencies to implement the Artificial Intelligence (AI) Executive Order. The draft emphasizes:

  • Designating Chief AI Officers.
  • Removing barriers to responsible AI use.
  • Managing risk in federal AI procurement. 

Moreover, agencies are urged to prioritize AI in IT infrastructure and ensure cybersecurity processes align with AI applications.

CISA’s AI Roadmap

Lastly, CISA’s Artificial Intelligence roadmap, unveiled on November 14, 2023, outlines strategic efforts, including responsibly using AI for cyber defense and protecting critical infrastructure. Plus, within the roadmap, CISA commits to:

  • incorporating AI systems into its Secure By Design Initiative.
  • Evaluating SBOM toolchains.
  • Confirming AI software coverage in SBOM assessments.
SBOM compliance

At SPK we highly recommend utilizing tools like GitLab for managing DevSecOps. You can learn more about GitLab and why they were named a Leader twice in 2023 for their AI-powered DevSecOps platform.

SBOM Compliance Supports Cybersecurity Resilience

As organizations fortify their cybersecurity defenses, the strategic integration of SBOM emerges as a cornerstone. So, by embracing SBOM compliance practices, organizations not only enhance their understanding of the software supply chain but also proactively manage and mitigate risks associated with open-source software. While incidents like Log4Shell provide valuable lessons, the broader focus on SBOM empowers organizations to navigate the ever-evolving landscape of cybersecurity with resilience and compliance at its core.

If you need support with cybersecurity in your organization, our team of software cybersecurity experts can help. Contact us here for a no obligation discussion.

Latest White Papers

Unlocking the Power of Asset Management in Your ITSM Practices

Unlocking the Power of Asset Management in Your ITSM Practices

Asset management is an important aspect of ITSM. Discovering the best way to manage yours can greatly increase your business’s efficiency. Assets in Jira Service Management allow organizations to manage hardware, software, facilities, people, and more. What You Will...

Related Resources

SPK Secures SOC 2 Type 1 Certification for Enhanced Service Offering

SPK Secures SOC 2 Type 1 Certification for Enhanced Service Offering

SCOTTS VALLEY, CA - Engineering and IT leader SPK and Associates is pleased to announce its achievement of SOC 2 Type 1 certification.  The SOC 2 Type 1 certification attests that SPK’s information security meets or exceeds the rigorous standards set forth by AICPA....

The Power of OKRs: Who Uses Them and Why They Work

The Power of OKRs: Who Uses Them and Why They Work

Organizations need more than just a solid business strategy. They need a framework to ensure that every team member aligns with the company's overarching goals.  This is where Objectives and Key Results (OKRs) come into play.  OKRs have become a powerful tool for...