Software Bill of Materials
Software Bill of Materials
Software-Stückliste
Also known as: SBOM
A machine-readable list of all components and dependencies of a piece of software with version and licence – the basis for licence review, vulnerability matching and manufacturer duties under the Cyber Resilience Act.
The European Union Agency for Law Enforcement Cooperation (incl. EC3) (Europol) report discusses the SBOM in connection with licensing of forensic tools: whoever distributes a tool must know the licences of every component it contains. The same list is how an operator knows, when a new vulnerability hits a library, which of its own systems are affected – matching it against the live vulnerability picture is the core of vulnerability management.