Why SBOMs Are the Key to Meeting Compliance Capabilities
Learn how SBOMs enable core compliance capabilities like inventory, risk assessment, and ongoing vulnerability monitoring—without being named explicitly in regulations.
•1:29•HD•0 views
Why SBOMs Are the Key to Meeting Compliance Capabilities
Transcript
When we talk about SBOMs in context, really what we're talking about is the idea that SBOMs are not required by name in most of these regulations or even in the security frameworks. They list out capabilities. Right? They talk about things that you need to be able to do without implying a solution.
So sometimes the language we might see is stuff like identify or inventory third party component. Right? We get language like that in these things. And, Nicole, if you can advance for me, please.
Then they go on to say, you need to be able to assess them for risk. They don't really get into what that means. Right? We we kinda understand what it means, but they don't say you have to use a CVSS score or anything like that. They just say you have to be able to assess them for risk.
And one more.
And then you also many of these, certainly in the world of IoT and any of, you know, these devices that are gonna live in the wild for, for years, unlike my days when I was supporting web apps and we could update it every month, we have to be able to provide ongoing monitoring and ability to deliver updates. Right? So the risks are temporal. They emerge over time, and we have to demonstrate through the regulators that we have these capabilities. Right?
So when you think of all of those things, SBOMs are a great way to approach it. Right? They provide that inventory. They give us a mechanism to assess them for risk and provide the ability to do ongoing monitoring.