CISA's New SBOM Guidelines Get Mixed Reviews

Updated SBOM rules from CISA are described as a solid step toward greater transparency for software and its components, but experts say they overlook several critical concerns in today’s software supply chain. The guidance requires SBOMs to include component hash and license, the name of the specific tool used to create the SBOM, a timestamp, and other identifiers to help defenders view each component, though some practitioners worry about providing that data without proper context.

According to Donna Ross, executive vice president and chief information security officer with Radian, there are implementation, standardisation and sharing worries, and while industry support is positive, it remains cautious. The guidelines also push for machine-readable formats such as SPDX and CycloneDX to drive automation, a change DigiCert’s Dave Roche described as a big positive step, noting that cryptographic hashes solve a long-standing barrier to operationalising SBOMs.

The draft is open for public comment through Oct. 3, and observers say more practical guidance from CISA—sector-specific playbooks, trust and sharing models, and enforcement details—would be welcome.