SBOMs

A Software Bill of Materials (SBOM) is a formal, machine-readable list of the components that make up a software product — libraries, dependencies, versions, and licenses.

SBOMs enable customers and operators to understand what is in the software they run, and to assess exposure when a new defect is disclosed in a component.

Without an SBOM, operators cannot efficiently answer the question: "Are we affected by this new defect?" SBOMs are a foundation for supply chain transparency.

Discussion prompts

• Do you produce SBOMs for your product today? Have you tested importing them as a customer might?
• When a major open-source defect is announced, how long does it take you to know if you and your customers are affected?
• How do your customers process SBOMs today? What is in their roadmaps?