CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

CISA Publishes Draft Software Bill of Materials Guide for Public Comment

First reported
Last updated
📰 2 unique sources, 2 articles

Summary

Hide ▲

The Cybersecurity and Infrastructure Security Agency (CISA) has released a draft of the Minimum Elements for a Software Bill of Materials (SBOM) for public comment. This updated guide reflects advancements in SBOM practices and provides a revised baseline for documenting and sharing software component information. The public can submit comments until October 3, 2025. The draft includes new elements such as component hash, license, tool name, and generation context, along with updates to existing elements for improved clarity. The goal is to enhance transparency in the software supply chain, enabling organizations to make risk-informed decisions and strengthen their cybersecurity posture. Industry experts have expressed mixed reviews, highlighting concerns about the practicality and operationalization of SBOMs despite the positive steps forward.

Timeline

  1. 22.08.2025 15:00 📰 2 articles · ⏱ 25d ago

    CISA Publishes Draft Software Bill of Materials Guide

    On August 22, 2025, CISA released a draft of the Minimum Elements for a Software Bill of Materials (SBOM) for public comment. The draft includes new elements such as component hash, license, tool name, and generation context, along with updates to existing elements for improved clarity. The public comment period concludes on October 3, 2025. Industry experts have expressed mixed reviews, highlighting concerns about the practicality and operationalization of SBOMs despite the positive steps forward. The new guidelines require component hashes and machine-readable formats to enhance transparency and solve data verification challenges. There is a call for more practical guidance and better vulnerability integration to make SBOMs truly operational.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

AI Adoption Guidelines for Cybersecurity Leaders

Cybersecurity leaders face challenges in safely adopting AI within organizations. Five key rules are outlined to balance innovation and protection. These rules focus on visibility, risk assessment, data protection, access controls, and continuous oversight. The goal is to enable safe AI usage without hindering productivity. AI adoption is accelerating, but it lacks necessary controls and safeguards. Security leaders must implement practical principles and technological capabilities to create a secure environment for AI usage. The rules emphasize the importance of visibility, contextual risk assessment, data protection, access controls, and continuous oversight.

Open in new tab

CISA Adjusts Cybersecurity Alerts and Notifications Strategy

The Cybersecurity and Infrastructure Security Agency (CISA) announced a temporary pause in implementing changes to its cybersecurity alerts and notifications strategy. This decision follows feedback from the cyber community regarding confusion caused by recent adjustments. CISA aims to re-evaluate the best approach to sharing timely and actionable information with stakeholders. The agency had previously announced changes to enhance user experience and highlight the most critical information for cyber defenders. The pause allows CISA to reassess and clarify its communication strategy.

Open in new tab