Software supply chain security: How SBOM reduces risks and ensures compliance

Why has software supply chain security become a top business priority?

Recent years have shown that traditional cybersecurity approaches are no longer sufficient. Attackers are increasingly targeting software supply chains, exploiting the trust between developers, vendors, and end-users. High-profile incidents, such as the SolarWinds attack or the Log4j vulnerability, demonstrated how a single compromised link can cripple thousands of organizations, leading to significant financial losses, reputational damage, and operational disruption ¹. These events have underscored the need for businesses to re-evaluate their security strategies, focusing on transparency and control over all software components.

SBOM as the foundation for proactive risk management: What is it and why is it important?

A Software Bill of Materials (SBOM) is a complete, formally structured inventory of all components included in a software product. It can be compared to an ingredient label on a food product. An SBOM includes information about proprietary components, third-party libraries, open-source software, as well as their versions, dependencies, and licenses ². The presence of an SBOM provides organizations with unprecedented transparency into their software stack, allowing them to identify potential vulnerabilities and risks before they are exploited. This is a fundamental step towards proactive risk management, as it shifts businesses from reactive patching to strategic threat anticipation and prevention.

Regulatory landscape and compliance: How SBOM meets CISA and EU CRA requirements?

The increasing number of attacks on software supply chains has led to stricter regulatory requirements. In the US, the Cybersecurity and Infrastructure Security Agency (CISA) actively promotes the use of SBOMs, issuing updated guidance on minimum SBOM elements. For example, CISA's 2026 updates include requirements for component hashes and expanded coverage for AI components ³. These requirements aim to establish a baseline level of security and trust in software. Concurrently, the European Union is implementing the Cyber Resilience Act (EU CRA), which places responsibility on software manufacturers for the security of their products ⁴. SBOM becomes a key tool for demonstrating due diligence and compliance with these requirements, helping organizations confirm the integrity of their software and avoid significant penalties.

From detection to response: Practical SBOM use cases

Accelerated vulnerability detection and remediation: When a new critical vulnerability (CVE) is discovered, an SBOM allows for quick identification of which software products and systems contain the vulnerable component, significantly reducing response and patching times.
License management and compliance: An SBOM provides a comprehensive overview of open-source software licenses, helping to avoid license agreement violations and associated legal risks.
Enhanced security when selecting third-party software: Evaluating SBOMs from vendors allows IT leaders to make informed decisions regarding the risks associated with third-party software.
Optimizing security audits and incident response: During an audit or incident investigation, an SBOM serves as a detailed map of the software, accelerating analysis and problem localization.

Implementing SBOM: Key formats and CI/CD pipeline integration

Standardized formats exist for effective SBOM generation and exchange: SPDX (Software Package Data Exchange) and CycloneDX. Both formats provide machine-readable descriptions of components.

SPDX vs. CycloneDX: Pros and cons

SPDX: More flexible, suitable for a wide range of data, including licenses and copyrights. Can be more complex to implement due to its comprehensiveness.
CycloneDX: Security-focused and geared towards vulnerability analysis, easier to implement for security purposes. May not provide the same level of detail regarding licenses as SPDX.

The choice of format depends on your business's specific needs and ecosystem.

Expert position

Kateryna Levchuk

Digital Workplace Expert

Implementing SBOM is not just another requirement, but a strategic step for Ukrainian businesses in the face of constant cyberattacks. Instead of waiting for a vulnerability to be discovered in a third-party component, SBOM allows proactive risk identification. For example, when a new critical CVE emerges, the security team can instantly check if that component is in any of their products and take prompt action, rather than a chaotic search. This significantly reduces response time and minimizes potential damage. A key criterion for the team: verify whether your security team can, within 4 hours of a new critical CVE publication (e.g., in NVD), accurately determine if the vulnerable component is present in any of your software products, using existing tools and SBOM data.

Expert profile →

Key to operationalizing SBOM is its integration into existing development and deployment processes (CI/CD pipeline). SBOM generation should be automated at various stages: after code build, during testing, and before deployment. This ensures that the SBOM is always up-to-date. Integrating SBOM generation tools (e.g., Syft, Tern, SPDX-tools) into your CI/CD pipeline provides continuous tracking of components and their vulnerabilities, transforming the SBOM from a one-time document into a dynamic security asset.

Decision-making tool: SBOM implementation readiness checklist

Assess your organization's readiness for implementing Software Bill of Materials practices by answering the following questions:

Do we have a complete inventory of all software components used (proprietary and third-party)?
Do we have processes in place to track and update information on component versions and dependencies?
Are vulnerability scanning tools integrated into our CI/CD pipeline?
Do we understand the regulatory requirements (CISA, EU CRA) for software security that apply to our business?
Do we have designated individuals responsible for managing software supply chain security?
Are we prepared to invest in tools and training for SBOM generation and management?
Do we have an incident response strategy that can be enhanced with an SBOM?
Do we have mechanisms for exchanging SBOMs with vendors and customers?

For implementing effective cybersecurity and vulnerability management solutions, Softline IT offers expertise and support. Learn more about our cybersecurity services.

Softline IT helps teams plan and implement cybersecurity, from an assessment of the current environment to an agreed change plan.