Software transparency is becoming the new security standard
CISA and international cybersecurity agencies have updated the minimum requirements for a Software Bill of Materials (SBOM), significantly strengthening software supply chain transparency. New mandatory elements, such as author digital signatures, hashes, licensing information, and the context of SBOM generation, ensure much better code integrity and traceability.
A robust SBOM must map all components and transitive dependencies, enabling organisations to identify and patch vulnerable software much faster. Machine-readable formats such as SPDX and CycloneDX are central to automated vulnerability management. These guidelines apply to open-source, AI, and SaaS, and align seamlessly with the growing obligations under frameworks such as the European Cyber Resilience Act (CRA).