Register
Software Bill of Materials Register
This register tracks Software Bill of Materials (SBOM) artefacts for the organization's internally-built software, for purchased commercial software, and for open-source dependencies in use. The register is the navigation layer over an SBOM repository; the actual SBOM artefacts (CycloneDX, SPDX) are stored as machine-readable files referenced by the register.
- Type
- Register
- Version
- 1.0.8
- Date
- 2026-10-27
- Owner
- Supplier Risk Maintainer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Supply Chain Governance
- Review frequency
- Quarterly and continuously updated upon every production build or supplier SBOM refresh
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Register schema
- SBOM acquisition
- Linkage to vulnerability management
- Linkage to procurement and acceptance
- Linkage to customer-facing transparency
- Operating expectations
- Framework alignment
- Limitations
Frameworks it maps to
- NTIA Minimum Elements of a Software Bill of Materials
- US Executive Order 14028
- CISA SBOM guidance
- EU Cyber Resilience Act
- NIST SP 800-218 Version 1.1
- NIST SP 800-161 Rev. 1
- ISO/IEC 5230 (OpenChain)
- CycloneDX
- SPDX
- VEX
- SLSA
Related documents
- Supplier and Cloud Governance Frameworksupply-chain
- Supplier Security and Privacy Assurance Standardsupply-chain
- Fourth-Party and Nth-Party Risk Proceduresupply-chain
- Software Composition Analysis Standarddev-security
- Developer Security Requirementsdev-security
- Vulnerability Management Proceduresecurity
- Third-Party and Supply Chain Risk Standardrisk
Next
All Documents