System Assurance PTF Agenda

Abstract

Software Bill of Materials (SBOM) is gaining attention recently. By itself, an SBOM has limited value, but there is great potential if properly integrated into effective cyber risk management processes and practices. The SEI SBOM Framework compiles a set of leading practices for building an SBOM and using it to support risk reduction. It provides a roadmap for managing vulnerabilities and risks in third-party software, including commercial-of-the-shelf (COTS) software, government-of-the-shelf (GOTS) software, and open-source software (OSS). A set of use cases informed the foundation for identifying SBOM practices, including building an SBOM and using it to manage risks to software intensive systems.  Those foundational practices were augmented using key security management concepts, such as the need to address requirements, planning and preparation, infrastructure, and organizational support. In this presentation, we will show how organizations can connect SBOMs to acquisition and development to support improved system and software assurance.