The SBOM Guide is a knowledge site about SBOMs (Software Bill of Materials): what an SBOM is, how it is used in vulnerability management and what regulations such as the Cyber Resilience Act (CRA) require.
Start here
- New to the subjectWhat is SBOM?
- Manufacture products sold in the EUThe CRA in brief
- Develop softwareHow to create an SBOM
Cyber Resilience Act (CRA)
The EU Cyber Resilience Act applies to products with digital elements sold in the EU, hardware and software alike. Among other things, manufacturers must draw up an SBOM and report actively exploited vulnerabilities.
- 10 December 2024
- The regulation entered into force
- 11 September 2026
- Reporting obligations started to apply
- 11 December 2027
- All requirements apply, including the SBOM
Topics
SBOM basics
What an SBOM is, what it contains and which types and formats exist.
Vulnerabilities and VEX
How vulnerabilities are assessed and prioritised, and how VEX states which ones affect a product.
SBOM in practice
Create an SBOM, build it into the pipeline, share it in the supply chain and require it in procurement.
Regulations
NIS2 and the Swedish Cybersecurity Act, DORA and an overview of which regulations require an SBOM.
Resources
Scale SBOM, SBOM Observer, authorities and links to sources.
About the SBOM Guide
The SBOM Guide is run by Bytesafe, made by Bitfront AB in Stockholm.
Questions, or found something that is wrong? Contact us.