CISA Requests Feedback on SBOM Updates to Address Real-World Gaps

The Cybersecurity and Infrastructure Security Agency (CISA) is intensifying efforts to develop Software Bills of Materials (SBOMs) as part of its new framework focused on enhancing machine-readable transparency. The agency aims to broaden the scope of what SBOMs should encompass for effective implementation in real-world scenarios.

On August 22, CISA published a draft update titled “Minimum Elements for a SBOM,” inviting public feedback on tools and practices that could advance software ingredient lists from theoretical constructs to actionable resources vital for vulnerability management and supply chain transparency. This draft introduces four additional data fields—component hash, license, tool name, and generation context—while refining existing fields like software producer, component version, and dependency relationships to mirror realistic generation, sharing, and utilization of SBOMs.

Allan Friedman, who recently led CISA’s SBOM initiatives and now advises on supply chain security, remarked that the objective of the updated guidance is to establish baseline expectations for SBOM contents and enhance data quality. He emphasized that while SBOM data is useful for confirming suppliers’ software comprehension and assisting security teams in risk management, existing tools remain insufficient for comprehensive SBOM management across organizations.

Friedman noted the prevalent challenge within SBOM deployment: a disconnect between the matured technology for SBOM generation and the limited availability of tools that translate that data into usable insights. He expressed optimism that the new guidance would facilitate wider integration of SBOM data into automated security workstreams, thereby reinforcing compliance and security assessments.

Industry analysts assert that the effectiveness of SBOMs significantly increases when they are paired with certificate lifecycle management, code signing, and additional layers of digital trust. Nonetheless, weaknesses persist, particularly given the control software vendors have over SBOM content. Vendors may omit certain dependencies before completing and distributing a “sanitized” SBOM, leaving end-users uncertain about the thoroughness of the disclosed information.

Experts caution that the draft guidance has notable gaps and assert that relying solely on SBOMs does not present a comprehensive view of security risks unless cross-referenced with vulnerability databases. While hashes help to establish authenticity, the standardization of SBOMs needs further refinement, alongside tighter integration with vulnerability management tools and automation solutions to ensure scalability in real-time cybersecurity operations.