SBOMs: From Best Practice to Legal Mandate

The Looming SBOM Mandate

The article effectively highlights the urgent need for Software Bills of Materials (SBOMs) due to impending legislation like the EU Cyber Resilience Act (CRA) and US executive orders. Viktor Petersson's insights underscore a critical shift from voluntary adoption to a legal obligation, with severe consequences for non-compliance, including market access denial. The discussion on SBOM generation quality, covering the four-stage process (creation, augmentation, enrichment, signing) and contrasting generic vs. domain-specific tools, provides valuable practical guidance. The emphasis on signing in CI as a crucial step for verifiable chain of custody is particularly noteworthy. Furthermore, the anticipation of future framework integrations like SOC 2 and ISO, along with the emerging OWASP TEA standard for artifact distribution, paints a comprehensive picture of the evolving SBOM landscape. The comparison of current SBOM management practices to pre-version control software development effectively conveys the immaturity and the need for robust processes.

However, a potential limitation is the rapid pace of regulatory change and the evolving nature of standards. While the article mentions SPDX and CycloneDX as dominant formats, the nuances of their interoperability and the ongoing development of newer standards or extensions could benefit from deeper exploration. The practical challenges of integrating SBOM generation into diverse existing CI/CD pipelines, especially for legacy systems or highly complex microservice architectures, might also warrant more detailed discussion. The article touches upon the difficulty of managing SBOMs across complex product stacks, but more concrete strategies for versioning and lifecycle management of these artifacts, beyond the analogy to 90s source code management, would be beneficial for teams facing this immediate challenge.

Key Points

• Software Bills of Materials (SBOMs) are transitioning from a best practice to a legal requirement due to upcoming regulations like the EU Cyber Resilience Act (CRA) and US executive orders.
• Non-compliance with SBOM mandates can lead to severe consequences, including blocking product sales from markets like the EU.
• High-quality SBOM generation involves a four-stage process: creation, augmentation, enrichment, and signing, with domain-specific tools often yielding better results than generic scanners.
• Signing SBOMs within the CI pipeline is critical for establishing a verifiable chain of custody.
• Managing SBOMs across complex software stacks requires robust versioning and lifecycle management, akin to modern source code control.
• Emerging standards like OWASP TEA aim to standardize the distribution of security artifacts, including SBOMs, through a universal API.

---

📖 Source: QCon London 2026: SBOMs Move From Best Practice to Legal Obligation as CRA Enforcement Looms