CISA's Updated SBOM Guidance Faces Persistent Adoption Hurdles
CISA and international partners have updated minimum elements for Software Bills of Materials, adding new data fields but facing criticism that adoption challenges remain unaddressed.
A global coalition of cybersecurity agencies, led by CISA, the NSA, and the FBI, has released an updated set of minimum elements for Software Bills of Materials (SBOMs). This revision, the first in five years, aims to enhance software supply chain security by providing a more comprehensive 'ingredients list' for software components. The update introduces 10 new data fields, including cryptographic hash values and license information for each component, alongside clarifications and renaming of existing fields to improve ambiguity.
The updated guidance expands its scope to explicitly include all software types, from open-source code to artificial intelligence systems and software-as-a-service offerings. It also broadens the requirement for dependency information, enabling recipients to better ascertain if a reported vulnerability affects their systems by understanding transitive dependencies. CISA stated that the enhancements reflect community advancements in supply chain security and aim to provide a modern, comprehensive picture of the software supply chain.
Despite these technical improvements, cybersecurity experts express skepticism about their impact on vendor adoption. Critics argue that the focus on minimum elements, while important, does not address the fundamental challenges hindering SBOM implementation. These include inconsistent tooling, immature consumption practices, and a lack of clear value proposition for software vendors and consumers.
Jeff Williams, founder of OWASP and CTO of Contrast Security, described the update as "just paperwork," emphasizing that the real value lies not in the list itself, but in how the software is built and secured. He pointed out that most applications contain libraries with embedded vulnerabilities that pose no actual risk because they are never utilized. Williams believes that without a focus on quality benchmarks, conformance testing, and demonstrable improvements in vulnerability response, updated SBOM requirements will merely refine the label without changing the product's underlying security.
The new guidance comes as regulatory pressure for SBOM adoption is mounting internationally. The European Union's Cyber Resilience Act mandates SBOMs for products with digital elements, and countries like Germany, India, and Japan have also published their own SBOM technical requirements. This external pressure may drive adoption where internal incentives have faltered.
CISA acknowledges the ongoing adoption struggles and has supported initiatives to streamline SBOM generation and sharing for resource-constrained organizations. However, the agency declined to comment on specific plans for conformance testing or future guidance beyond the published minimum elements. The effectiveness of these updated minimum elements will ultimately depend on whether they can overcome the persistent adoption barriers and provide tangible security benefits.
The evolution of SBOMs reflects a broader effort to increase transparency and accountability in the software supply chain, a critical area highlighted by past major incidents like the SolarWinds attack. While the updated guidance represents a step forward in defining what constitutes a comprehensive SBOM, the cybersecurity community will be watching closely to see if it translates into meaningful improvements in software security practices.