Software Bill of Materials

History & facts. Modern software consists for the most part of third-party building blocks (open-source libraries, frameworks). At the latest, the Log4Shell incident in 2021 painfully demonstrated that many organisations did not know everywhere a vulnerable component was embedded. The SBOM answers exactly this question. In the European Union (EU), the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) creates a concrete obligation: manufacturers of products with digital elements must create a machine-readable SBOM and use it for vulnerability handling. Important: the SBOM does not have to be published (so the Federal Office for Information Security (Germany) (BSI) explicitly states). On timing: the CRA entered into force on 10 Dec 2024; the reporting obligations take effect from 11 Sep 2026, full application — including the SBOM obligation, CE marking and conformity assessment — from 11 Dec 2027. In practice, however, the SBOM is needed already from September 2026, because without it one can hardly report actively exploited vulnerabilities on time.

Outlook & recommendation. The SBOM is evolving from optional to mandatory — and is at the same time simply good practice. Recommended are established, machine-readable formats (CycloneDX, SPDX), automated generation in the CI/CD pipeline and linkage with vulnerability and exploit data (see Known Exploited Vulnerabilities Catalog (KEV), Exploit Prediction Scoring System (EPSS)) as well as with Vulnerability Exploitability eXchange (VEX), which states whether a vulnerability is actually exploitable in the product. This turns a list into an effective tool that, in an emergency, costs hours instead of weeks. For suppliers and operators alike, the SBOM is a central building block of supply chain security.