Sometimes Sequels Are Good: CISA’s Update To the 2021 NTIA SBOM Minimum Elemen...
Talkat Open Source Summit Europe 2025 · on Tuesday, 2025-08-26· at 11:00· Elicium 2A (Elicium Level 1)·
summary
CISA publishes a draft 2025 update to the 2021 NTIA SBOM Minimum Elements that renames fields (e.g., SBOM author, component version), adds new required fields like component hash, license, tool name, generation context, and requires a software identifier (examples include Omnibore) with pedigree for backports/forks. The draft endorses automation formats SPDX and CycloneDX, folds access-control guidance into distribution, redefines depth as “coverage,” and opens a Federal Register comment period through October 3.
AI-written summary · about
chapters (17)
- 0:00CISA’s SBOM update intro
- 2:06What is SBOM and why it matters
- 3:54US SBOM journey since 2021
- 8:09SBOM implementation changes
- 10:19SBOM minimum elements updates
- 12:53New SBOM minimum elements
- 15:24Refining SBOM practices
- 17:53SBOM automation support
- 18:55SBOM coverage vs depth
- 21:05Public comment period
- 23:16Harmonizing SBOM with EU CRA
- 26:42Submit feedback on draft
- 29:15CISA SBOM guidance scope
- 31:18CISA and NTIA SBOM elements
- 33:17Future SBOM updates timeline
- 36:49US SBOM requirement vs EU CRA
- 38:37Handling multiple SBOM files
related talks
22mSBOM and Security Transparency - How it all fits together
44mSBOM in SaaS Environments: An Update
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity
26mSBOM Open Questions
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
30mTransparency in the Software Supply Chain: Making SBOM a Reality
26mSBOM today: What is the state of SBOMs?
52mThe World on SBOMs