Governments worldwide are implementing strict SBOM regulations to strengthen
software supply chain security — enhancing transparency, reducing vulnerabilities,
and requiring proactive risk measures.
Track SBOM, vulnerability disclosure, incident reporting, and software transparency
obligations by region, industry, and enforcement stage.
103Regulations tracked
23Explicit SBOM signals
31Dated deadlines
19
matching obligations
Effective
APRA CPS 234 Information Security
Asia Pacific · Australia · Financial Services
Information security standard requiring APRA-regulated entities
to manage information security capability, controls, incidents,
testing, audit, and third-party control assurance.
Information Security
Incident Reporting
Third-Party Risk
Control Assurance
Audit Trail
Standard
Implicit SBOM relevance
Official Source ↗
Effective
01/07/2019
Deadline
1/07/2019
Evidence to prepare
Information asset inventory, third-party control assurance,
security testing, incident notification records, and internal
audit evidence.
Exodos note
Component and supplier inventories support information asset
classification and third-party assurance.
Guidance
Auto-ISAC SBOM Best Practices
Global · Automotive Industry · Automotive & Mobility
Industry best-practice guidance for automotive suppliers on
producing, sharing, and consuming SBOMs across the vehicle
supply chain.
SBOM
Automotive Supply Chain
Best Practice
Guidance
Explicit SBOM relevance
Official Source ↗
Type
Industry guidance and best practices.
Evidence to prepare
Current SBOMs, supplier software inventories, and processes
for producing and exchanging component information.
Effective
Brazil BACEN Resolution 4,893
Latin America · Brazil · Financial Services
Brazil Central Bank cybersecurity policy and cloud outsourcing
requirements for financial institutions and payment institutions.
Cybersecurity governance, outsourcing controls, incident
response, and third-party risk management.
Effective
Canada OSFI Guideline B-10
North America · Canada · Financial Services
OSFI third-party risk guidance requiring federally regulated
financial institutions to manage risks across outsourced and
other third-party arrangements.
Third-party risk, supplier governance, operational resilience,
and supporting audit evidence.
Effective
APRA CPS 234 Information Security
Asia Pacific · Australia · Financial Services
Information security standard requiring APRA-regulated entities
to manage information security capability, controls, incidents,
testing, audit, and third-party control assurance.
Information SecurityIncident ReportingThird-Party RiskControl AssuranceAudit TrailStandard
Implicit SBOM relevance
Official Source ↗
Evidence to prepare
Information asset inventory, third-party control assurance,
security testing, incident notification records, and
internal audit evidence.
Guidance
Auto-ISAC SBOM Best Practices
Global · Automotive Industry · Automotive & Mobility
Industry best-practice guidance for automotive suppliers on
producing, sharing, and consuming SBOMs across the vehicle
supply chain.
SBOMAutomotive Supply ChainBest PracticeGuidance
Explicit SBOM relevance
Official Source ↗
Type
Industry guidance and best practices.
Effective
Brazil BACEN Resolution 4,893
Latin America · Brazil · Financial Services
Brazil Central Bank cybersecurity policy and cloud outsourcing
requirements for financial institutions and payment institutions.
OSFI third-party risk guidance requiring federally regulated
financial institutions to manage risks across outsourced and
other third-party arrangements.
Information security standard requiring APRA-regulated entities
to manage information security capability, controls, incidents,
testing, audit, and third-party control assurance.
Information SecurityIncident ReportingThird-Party RiskControl AssuranceAudit TrailStandard
Implicit SBOM relevance
Official Source ↗
Evidence to prepare
Information asset inventory, third-party control assurance,
security testing, incident notification records, and internal
audit evidence.
Guidance
Auto-ISAC SBOM Best Practices
Global · Automotive Industry · Automotive & Mobility
Industry best-practice guidance for automotive suppliers on
producing, sharing, and consuming SBOMs across the vehicle
supply chain.
SBOMAutomotive Supply ChainBest PracticeGuidance
Explicit SBOM relevance
Official Source ↗
Type
Industry guidance and best practices.
No matching obligations
Try changing or clearing your filters.
Free Trial
Start Your 14-Day Free Trial Today
Join security and engineering teams who have transformed their SBOM
management from a compliance burden into a strategic advantage.
