DID FinderBack
Source
DI-SESS-82433

Cybersecurity Supply Chain Risk Management (C-SCRM) Software Bill of Material (SBOM) Requirements

Specifies requirements for a Software Bill of Materials (SBOM) that includes comprehensive software component information and upstream relationship assertions, in alignment with CISA and NTIA guidelines, to support Cybersecurity Supply Chain Risk Management (C-SCRM) activities.

Approval DateJanuary 19, 2024
AMSC NumberN10452
Preparing ActivityAS
Project NumberSESS-2024-002
OPR—
DTIC Applicable—
GIDEP Applicable—
Limitation—
Applicable Forms—
Approval Limitation—
Form Version—
DID Formatfree_text
963C CompliantYes
DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.
Supersedes
—
Related
—

Description & Purpose

—

Application & Interrelationship

—

Use & Relationship

Data delivered using this Data Item Description (DID) specifies the requirements for a Software Bill of Materials (SBOM) that includes comprehensive software component information and upstream relationship assertions in alignment with CISA and NTIA guidelines. The SBOM will ensure suppliers/vendors maintain and/or improve Cybersecurity Supply Chain Risk Management (C-SCRM) activities. This approach provides a consistent and repeatable approach for sharing product component data.

a. SBOM Types. Vendors should specify the type of SBOM provided based on the software development stage. Possible types include Design, Source, Build, Analyzed, Deployed, and Runtime SBOMs.

b. Each software component entry must include information about its upstream relationships.

c. The word "item" is used throughout the document to refer to software components of the system.

d. This DID contains the format, content, and intended use information for the data product resulting from the work task described in the solicitation.

e. This DID should be tailored in the Contract Data Requirements List (CDRL) to include only the required specific data elements from Table 1. Examples of specific uses for the data and the data elements that could be used for each purpose follows:

(1) Software Bill of Materials (SBOM) data can be used to establish the details and supply chain relationships of various components used in building in a system. The SBOM will provide managers essential information that enables the identification, forecasting, mitigation, and management of software security. The data will be used to form a foundational data layer on which further security tools, practices, and assurances can be built.

Preparation Instructions

1Reference documentsThe applicable issue of the documents cited herein, including their approval dates and dates of any applicable amendments, notices, and revisions, shall be as specified in the contract.
1.1References
1.1.1The Minimum Elements For a Software Bill of Materials (SBOM)https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf
1.1.2Types of Software Bill of Materials (SBOM)https://www.cisa.gov/resources-tools/resources/types-software-bill-materials-sbom
1.1.3Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)https://www.ntia.gov/files/ntia/publications/ntia_sbom_framing_2nd_edition_20211021.pdf
1.1.4Minimum Requirements for Vulnerability Exploitability eXchange (VEX)https://www.cyclonedx.org/specification/overview/
2FormatThe C-SCRM SBOM shall be submitted in English and machine-readable format to ensure interoperability and automation support.
3ContentInclude a complete inventory of all first party and third party components in the SBOM. The data shall contain the information specified by the contract as referenced by the Data Items in Table 1. The data shall meet the requirements as specified in the Description column of Table 1. All fields designated by the contract shall be included. Fields for which data is not available shall be left blank. The data shall be included to the lowest indenture level (component level) for all items, including subcontractor items. Adhere to NTIA guidance on documenting upstream relationships, ensuring transparency and clarity in the software supply chain as referenced in Example 1.
3.1Vulnerability-Exploitability eXchange (VEX) InformationIn addition to SBOM data, vendors are encouraged to provide VEX information for each software component listed in the SBOM, where such information is available and applicable.
3.1.1The VEX should include, for each vulnerabilityThe VEX should include, for each vulnerability, a status (e.g., Not affected, Affected, Fixed, Under Investigation) and any recommended actions or remediation to address the vulnerability.
3.1.2VEX information should be regularly updatedVEX information should be regularly updated to reflect the status of vulnerabilities, especially after significant software updates or when new vulnerabilities are discovered.
3.1.3Vendors should ensure that VEX dataVendors should ensure that VEX data is synchronized with the corresponding SBOM data.

References

The Minimum Elements For a Software Bill of Materials (SBOM) https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf

Types of Software Bill of Materials (SBOM) https://www.cisa.gov/resources-tools/resources/types-software-bill-materials-sbom

Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM) https://www.ntia.gov/files/ntia/publications/ntia_sbom_framing_2nd_edition_20211021.pdf

Minimum Requirements for Vulnerability Exploitability eXchange (VEX) https://www.cyclonedx.org/specification/overview/

Figures

Figure Table 1: TABLE 1 Data Items

Figure Table 1. TABLE 1 Data Items

Figure Table 1 (continued): TABLE 1 Data Items (continued)

Figure Table 1 (continued). TABLE 1 Data Items (continued)

Figure Figure 2: Conceptual SBOM graph with upstream relationship assertions

Figure Figure 2. Conceptual SBOM graph with upstream relationship assertions

Schema v3.0Community-maintained · Verify against ASSIST
Community-maintained — not an official government database.
Verify against ASSIST·GitHub·About·Disclaimer