SBOM
A formal record detailing all components, libraries, and dependencies within a software product. SBOMs are used to manage software supply chain transparency and support security compliance.
Core Facts
Timeline (last 90 days)
Artifact provenance refers to recording in software releases the origin of build artifacts, dependency versions, compilation environment, and signing information, with common practices including generating SBOMs, checksums, and build logs.
An SBOM lists all open-source and third-party components and their version information in a software product in machine-readable format, enabling rapid assessment of whether a device is affected when new vulnerabilities are disclosed.
In its 2023 cybersecurity guidance, FDA explicitly requires medical device manufacturers to submit an SBOM (Software Bill of Materials) prior to market approval.
An SBOM is a structured inventory that lists all components of a piece of software, including direct and transitive dependencies, version numbers, and licenses.
Container security recommendations include using Trivy to scan for vulnerabilities, verifying signatures with Cosign, and attaching an SBOM file.
Leveraging dependency scanning tools, software bills of materials (SBOM), and signature verification mechanisms can enable timely detection of known vulnerabilities and anomalous changes.
Docket's approach is similar to SBOM or the SLSA framework in the software supply chain security space, but answers which agent generated a commit, under what context, and through what verification steps.
Locking dependency versions, using a Software Bill of Materials (SBOM), and continuously scanning with tools such as Dependabot or OpenSSF Scorecard have become standard practices for security in mature open-source projects
Software Bill of Materials (SBOM) has been mandated by a U.S. government executive order for use in federal software procurement.
The White House issued Executive Order EO 14028 on improving national cybersecurity, requiring software vendors to provide SBOMs (Software Bills of Materials).
3 more timeline events
All Facts (15)
The 2021 U.S. Presidential Executive Order (EO 14028) requires federal software suppliers to provide a Software Bill of Materials (SBOM).
80%Unverified美国政府在SolarWinds和Log4Shell事件后发布行政令要求推行软件物料清单（SBOM），欧盟推出《网络弹性法案》将开源软件安全责任纳入监管框架
90%UnverifiedAn SBOM is a structured inventory that lists all components of a piece of software, including direct and transitive dependencies, version numbers, and licenses.
60%UnverifiedArtifact provenance refers to recording in software releases the origin of build artifacts, dependency versions, compilation environment, and signing information, with common practices including generating SBOMs, checksums, and build logs.
50%UnverifiedIn its 2023 cybersecurity guidance, FDA explicitly requires medical device manufacturers to submit an SBOM (Software Bill of Materials) prior to market approval.
50%UnverifiedAn SBOM lists all open-source and third-party components and their version information in a software product in machine-readable format, enabling rapid assessment of whether a device is affected when new vulnerabilities are disclosed.
50%UnverifiedContainer security recommendations include using Trivy to scan for vulnerabilities, verifying signatures with Cosign, and attaching an SBOM file.
50%UnverifiedLeveraging dependency scanning tools, software bills of materials (SBOM), and signature verification mechanisms can enable timely detection of known vulnerabilities and anomalous changes.
50%UnverifiedDocket's approach is similar to SBOM or the SLSA framework in the software supply chain security space, but answers which agent generated a commit, under what context, and through what verification steps.
50%UnverifiedLocking dependency versions, using a Software Bill of Materials (SBOM), and continuously scanning with tools such as Dependabot or OpenSSF Scorecard have become standard practices for security in mature open-source projects
50%UnverifiedSoftware Bill of Materials (SBOM) has been mandated by a U.S. government executive order for use in federal software procurement.
50%UnverifiedThe White House issued Executive Order EO 14028 on improving national cybersecurity, requiring software vendors to provide SBOMs (Software Bills of Materials).
50%UnverifiedThe mainstream SBOM standards SPDX and CycloneDX primarily focus on packaged dependencies and have not yet adequately covered runtime SaaS API dependencies.
50%UnverifiedFollowing the SolarWinds incident and the Log4Shell vulnerability, the U.S. White House issued Executive Order EO 14028, requiring software vendors to provide an SBOM (Software Bill of Materials).
50%Unverified软件领域的 SBOM 概念正在向机器学习领域延伸，催生了 Model Card 和 ML-BOM 等模型元数据标准
50%