SBOM - Software Bill of Materials

Digital systems consist of numerous components. This applies in particular to software, which often comprises hundreds of libraries. Components can be either commercial or open-source. The CRA requires manufacturers and operators to identify the components used in their systems. This requirement applies not only to components used directly but also to their dependencies. Each component may be composed of other components, which in turn consist of components, and so on. The complete list of all components is referred to as a Software Bill of Materials (SBOM).

In addition to the disclosure requirement, the identification of a complete SBOM is a prerequisite for addressing known security vulnerabilities. If known vulnerabilities exist for a component in use, regardless of the level (direct or transitive dependency), the product cannot be released in its current form or must be patched. However, such vulnerabilities can only be tracked if all dependencies are fully known.

Our Services

Fraunhofer SIT supports companies in processes for creating an initial SBOM for existing systems as well as in integrating the SBOM into development processes to ensure it remains up-to-date without unnecessarily burdening the processes with manual work. Therefore, we rely on automated approaches wherever possible. Essential SBOM information—assuming modern development processes—is already contained in the development files and can be extracted from them. If this is not the case with older processes, it is advisable to adapt the processes due to the obligation to address security vulnerabilities and provide updates in a timely manner. Feel free to call us or send an email directly to our expert!