SBOM Regulations

Select

ISO/IEC 27090 AI Security Threats and Compromises

Global · International · AI & Data, Software & Digital Services, Critical Infrastructure · effective

effective

ISO and IEC published ISO/IEC 27090:2026 on 14 October 2026 as a voluntary guidance standard for understanding, detecting and mitigating security threats and compromises specific to AI systems throughout their lifecycle. It covers protection needs spanning training data, AI models, workflows, operation, updates and retraining, including data poisoning and model theft. Publication makes the standard available for adoption but does not itself create a regulatory mandate.

Primary provision ISO/IEC 27090:2026, Clause 1 (scope) and Clauses 5-6 (application of information security and types of potential compromise to AI systems) ISO/IEC 27090 provides guidance on understanding, detecting and mitigating security threats specific to artificial intelligence (AI) systems throughout their life cycle.

AI Security AI Supply Chain Lifecycle Security Threat Detection Data and Model Protection Evidence adjacent SBOM relevance Standard

Select

UK DWP Security Standard SS-003: Software Development

Europe · United Kingdom · Government & Public Sector, Software & Digital Services, AI & Data · effective

effective

DWP's version 2.1 software-development security standard, approved 30 July and published on GOV.UK on 7 October 2026, applies across DWP and its contracted supplier base for software handling Authority data when incorporated into the contract security schedule. It requires complete SBOMs for bespoke applications, microservices and integrated third-party components; automated CycloneDX or SPDX generation and SCA in modern CI/CD; release-by-release SBOM maintenance for legacy environments; supplier assessment, secure artefacts and build provenance; and controls for AI-generated code, coding assistants and agentic workflows. Publication of a changed standard does not automatically change existing contracts.

Primary provision DWP Security Standard - Software Development (SS-003), version 2.1, Sections 10, 11.1.5, 11.1.24-11.1.28, 11.13.5 and 11.14.1-11.14.9; approved 30 July 2026 and published on GOV.UK 7 October 2026 A complete Software Bill of Materials (SBoM) must be generated, maintained, and made available upon request for all bespoke applications, microservices, and integrated third-party components.

SBOM Supply Chain Security Secure Development Vulnerability Management AI Coding Governance Build Provenance Supplier Assurance Evidence explicit SBOM relevance Standard

Select

UK DWP Technical Vulnerability and Continuous Threat Exposure Management Security Policy

Europe · United Kingdom · Government & Public Sector, Software & Digital Services, General Enterprise · effective

effective

Updated DWP policy published 7 October 2026 for DWP teams and contracted third-party suppliers whose systems or services handle Authority information, where the policy is incorporated into the contract security schedule. It requires continuous threat exposure management, near-real-time asset visibility, a continuously maintained hardware, software, firmware and service inventory, continuous scanning of internet-facing assets, at least weekly authenticated internal scanning, documented risk-based remediation and supplier monitoring. Mature environments must include SBOMs in the inventory. Publication of a changed policy does not automatically change existing contracts.

Primary provision DWP Technical Vulnerability and Continuous Threat Exposure Management Security Policy, updated 7 October 2026, Sections 3.1-3.5, 6.1-6.17 and 8.5-8.9; DWP procurement publication applicability notice In mature environments, this must include Software Bill of Materials (SBOM), Identity and Access Data, and Firewall Rule Analysis.

Vulnerability Management SBOM Asset Inventory Continuous Monitoring Risk-Based Remediation Supplier Risk Procurement Security Evidence explicit SBOM relevance Policy

Select

UK Government Functional Standard GovS 005: Digital

Europe · United Kingdom · Government & Public Sector, Software & Digital Services, AI & Data · effective

effective

Updated mandatory functional standard for UK government departments and in-scope bodies governing digital and data activity across the full lifecycle. The October 2026 version expressly covers AI-enabled components, supplier assurance, vulnerability identification and remediation, secure patching, component and dependency documentation, configuration management and retirement of technology that can no longer be updated or secured.

Primary provision Government Functional Standard GovS 005: Digital, updated 1 October 2026, Sections 5.3, 5.4, 6.2, 6.3 and 8.8 Services should be documented so their architecture, components and connections are defined and understood.

AI Component Governance Vulnerability Management Secure Updates Supplier Risk Procurement Security Configuration Management Lifecycle Security Evidence implicit SBOM relevance Standard

Select

Japan Information Security Early Warning Partnership Guideline

Asia-Pacific · Japan · Software & Digital Services, Connected Products & IoT, Critical Infrastructure · guidance

guidance

IPA and JPCERT/CC's 2026 coordinated vulnerability disclosure guideline defines intake, developer verification, remediation and coordinated publication for software and website vulnerabilities. The revision integrates NICT and a Cabinet Office notification path under Japan's Active Cyber Defense Act for exploited, suspected-exploited, severe or potentially wide-impact vulnerabilities.

Primary provision Information Security Early Warning Partnership Guideline (2026), Section IV.1 and Section IV.5; Appendix 7; Active Cyber Defense Act Articles 37, 38, 40-42 and 45 製品開発者は、製品に脆弱性が存在する場合には、その対策に関して適切な対応をすることが望まれます。

Vulnerability Disclosure Vulnerability Management Product Security Incident Coordination Government Notification Remediation Evidence implicit SBOM relevance Guidance

Select

Italy ACN NIS Implementation Vademecum

Europe · Italy · Critical Infrastructure, Software & Digital Services, Government & Public Sector · guidance

guidance

ACN's first NIS implementation vademecum explains Italy's existing NIS2 compliance calendar. Shared information includes relevant suppliers, with changes reported within 14 days and an annual verification window from 15 April to 31 May. For the 2025-listed cohort, base security measures are due in October 2026; for entities registered by 28 February 2025 the precise statutory deadline is 18 months after receipt of the inclusion notice. The 2026-listed cohort's calendar places base measures in July 2027.

Primary provision ACN Vademecum NIS, version 1.0 (September 2026; release announced 11 September 2026), Sections 2 (p. 3, footnotes 2-3) and 3.2 (pp. 4-5, relevant supplier list); Legislative Decree 138/2024, Article 7(4), 7(7) and 42 l’elenco dei fornitori rilevanti.

Supply Chain Security Supplier Risk Governance Evidence implicit SBOM relevance Guidance

Select

ENISA Healthcare Cybersecurity Procurement Guidelines

Europe · European Union · Healthcare & Life Sciences, Government & Public Sector, Software & Digital Services · guidance

guidance

ENISA guidance translating EU healthcare cybersecurity policy into procurement measures for hospitals and healthcare providers, including supplier assessment, tender requirements, security documentation, contract clauses, secure operation, vulnerability disclosure, patching, and end-of-life handling.

Primary provision ENISA Procurement Guidelines for the Cybersecurity of Hospitals and Healthcare Providers, Annex B procurement checklist certified or independently assessed security postures

Supplier Risk Procurement Security Vulnerability Disclosure Patch Management Security Standards Certification Evidence Contractual Reporting Secure Operation Evidence implicit SBOM relevance Guidance

Select

US FY2027 NDAA Artificial Intelligence Functional Bill of Materials (AIBOM)

North America · United States · Government & Public Sector, AI & Data, Software & Digital Services · proposed

proposed

Proposed FY2027 NDAA Section 1652 would require DFARS updates barring DoD contracts for goods or services that use AI unless the contractor submits an AIBOM before award, renewal, or extension and maintains it for updates to DoD components within 48 hours.

Primary provision S. 4784 RS, FY2027 NDAA, Section 1652(a)-(d), Artificial Intelligence Functional Bill of Materials include details related to the software, data, and hardware

AIBOM SBOM AI Supply Chain Model Transparency Dataset Transparency Hardware Transparency Procurement Security Secure Sharing Evidence Contractual Reporting explicit SBOM relevance Bill / Proposal

Select

CISA/G7 Software Bill of Materials for AI Minimum Elements

Global · G7 / United States / European Union / Japan / United Kingdom / Canada · AI & Data, Software & Digital Services, Critical Infrastructure · guidance

guidance

Joint CISA and G7 guidance defining supplemental minimum elements for SBOMs used with AI systems, including model, dataset, infrastructure, security, and system-level transparency.

Primary provision CISA/G7 Software Bill of Materials for AI - Minimum Elements AI systems are software systems

AIBOM AI SBOM SBOM Model Transparency Dataset Transparency AI Supply Chain Evidence explicit SBOM relevance Guidance

Select

US CIRCIA Cyber Incident Reporting

North America · United States · Critical Infrastructure, Healthcare & Life Sciences, Financial Services · proposed

proposed

US critical infrastructure incident reporting law requiring CISA to finalize rules for covered cyber incident and ransom payment reporting by covered entities.

Primary provision CIRCIA covered cyber incident and ransom payment reporting report covered cyber incidents to CISA

Incident Reporting Ransomware Reporting Evidence Critical Infrastructure Governance adjacent SBOM relevance Regulation

Select

US FCC Cyber Trust Mark

North America · United States · Connected Products & IoT · guidance

guidance

Voluntary US cybersecurity labeling program for consumer IoT products, built around conformance testing, label authorization, registry information, and NIST technical criteria.

Primary provision FCC IoT cybersecurity labeling program, Report and Order FCC 24-26 U.S. Cyber Trust Mark

IoT Labeling Product Security Vulnerability Management Secure Updates Technical Documentation adjacent SBOM relevance Certification

Select

UK Network and Information Systems Regulations

Europe · United Kingdom · Critical Infrastructure, Software & Digital Services · effective

effective

UK framework for network and information system security in operators of essential services and relevant digital service providers, with security and incident reporting duties.

Risk Management Incident Reporting Operational Resilience Evidence Governance implicit SBOM relevance Regulation

Select

UK PRA Operational Incident and Third-Party Reporting

Europe · United Kingdom · Financial Services · upcoming

upcoming

PRA policy for more consistent reporting of operational incidents and material third-party arrangements by regulated financial firms.

Incident Reporting Third-Party Risk Operational Resilience Supplier Risk Evidence adjacent SBOM relevance Regulation

Select

UK Software Security Code of Practice

Europe · United Kingdom · Software & Digital Services, General Enterprise, Government & Public Sector · guidance

guidance

UK government software vendor guidance designed to reduce software supply chain attacks and resilience incidents through secure design, development, deployment, communication, and procurement practices.

Primary provision UK Software Security Code of Practice and NCSC implementation guidance, Theme 1 reducing the likelihood and impact of software supply chain attacks

SBOM Secure Development Supplier Risk Vulnerability Management Software Transparency Evidence explicit SBOM relevance Guidance

Select

Australia Cyber Security Act 2024

Asia-Pacific · Australia · General Enterprise, Critical Infrastructure, Software & Digital Services · effective

effective

Australian cyber reform package introducing ransomware and cyber extortion payment reporting and broader cyber incident coordination mechanisms.

Primary provision Cyber Security Act 2024, ransomware payment reporting ransomware payment and cyber extortion payment reporting

Ransomware Reporting Incident Reporting Evidence Governance Critical Infrastructure adjacent SBOM relevance Regulation

Select

Australia Security Standards for Smart Devices

Asia-Pacific · Australia · Connected Products & IoT, Software & Digital Services · effective

effective

Australian rules introducing mandatory cyber security standards for most consumer smart devices, with obligations that create a need for product software inventory, update, and vulnerability evidence.

Primary provision Cyber Security (Security Standards for Smart Device) Rules 2025 mandatory cyber security standards

Product Security Secure Updates Vulnerability Management Conformity Evidence Software Transparency implicit SBOM relevance Regulation

Select

Australia Security of Critical Infrastructure Act

Asia-Pacific · Australia · Critical Infrastructure, Healthcare & Life Sciences · effective

effective

Critical infrastructure security framework with mandatory cyber incident reporting and risk management obligations for covered assets.

Incident Reporting Critical Infrastructure Risk Management Supplier Risk Evidence implicit SBOM relevance Regulation

Select

Singapore CSA Advisory on Securing the Software Supply Chain

Asia-Pacific · Singapore · Software & Digital Services, Government & Public Sector, General Enterprise · guidance

guidance

Singapore CSA guidance for managing software supply-chain risk across third-party acquisition, package installation, build automation, API integration, and development workflows. It calls for a visible SBOM, dependency controls, secure CI/CD, continuous monitoring, and contractual vendor safeguards.

Primary provision Cyber Security Agency of Singapore Advisory AD-2026-003, Recommended Measures: Strengthen Governance of Software Components Visible Software Bill of Material (SBOM).

SBOM Supply Chain Security Secure Development Vulnerability Management Incident Response Supplier Risk explicit SBOM relevance Guidance

Select

Singapore Government ICT&SS Software Supply Chain Controls

Asia-Pacific · Singapore · Government & Public Sector, Software & Digital Services · guidance

guidance

Singapore Government ICT&SS control catalogue for protecting the integrity of the software supply chain. The SC control group covers repositories, commit signing, peer review, dependency pinning, reproducible build and release records, deployment controls, and artefact signing and verification.

Primary provision Singapore Government ICT&SS Policy Reform, Software Supply Chain controls SC-1 through SC-9 Pin direct and transitive dependency versions.

Secure Development Supply Chain Security Software Integrity Artifact Signing Evidence implicit SBOM relevance Government Policy

Select

Canada Critical Cyber Systems Protection Act

North America · Canada · Critical Infrastructure, Financial Services, Software & Digital Services · effective

effective

Canadian cyber security law establishing a framework to protect critical cyber systems, including operator obligations for cyber security programs, incident reporting, supply chain risk, and third-party dependencies.

Primary provision Bill C-8, Critical Cyber Systems Protection Act protect critical cyber systems

Supply Chain Security Third-Party Risk Incident Reporting Cybersecurity Program Evidence implicit SBOM relevance Regulation

Select

Canadian Centre for Cyber Security Software Supply Chain Guidance

North America · Canada · Critical Infrastructure, Government & Public Sector, Software & Digital Services · guidance

guidance

Canadian guidance for protecting organizations from software supply chain threats, including supplier assessment and software component inventory/SBOM considerations.

SBOM Supplier Risk Supply Chain Security Vulnerability Management Risk Management explicit SBOM relevance Guidance

Select

Japan Cyber Infrastructure Provider Guidelines

Asia-Pacific · Japan · Software & Digital Services · guidance

guidance

Final METI and National Cybersecurity Office guidelines defining roles and evaluation checklists for providers and customers that develop, supply, and operate software, cloud services, embedded software, firmware, and cyber infrastructure. The final framework organizes supply-chain cybersecurity responsibilities into six categories.

Primary provision METI and National Cybersecurity Office, Guidelines on the Roles Expected of Cyber Infrastructure Providers, final version and evaluation checklists improve cybersecurity resilience across the entire software supply chain

Secure Development Supplier Risk Vulnerability Management Procurement Security Governance Evidence implicit SBOM relevance Guidance

Select

China Cybersecurity Law

Asia-Pacific · China · Critical Infrastructure, General Enterprise · effective

effective

Foundational Chinese cybersecurity law covering network operator security duties, critical information infrastructure protections, security incidents, and network product obligations.

Risk Management Incident Response Critical Infrastructure Product Security Vulnerability Management Evidence implicit SBOM relevance Regulation

Select

Korea Act on Protection of Information and Communications Infrastructure

Asia-Pacific · South Korea · Critical Infrastructure, Government & Public Sector, Software & Digital Services · effective

effective

Korean framework for protecting major information and communications infrastructure against electronic intrusion and disruption.

Critical Infrastructure Risk Management Incident Response Evidence Governance implicit SBOM relevance Regulation

Select

Korea KISA IoT Security Certification

Asia-Pacific · South Korea · Connected Products & IoT · guidance

guidance

KISA IoT security certification evaluates connected devices across authentication, data protection, cryptography, software security, updates, technical support, OS, network, and hardware security.

IoT Labeling Product Security Secure Updates Vulnerability Management Conformity Evidence adjacent SBOM relevance Certification

Select

Saudi NCA Essential Cybersecurity Controls

Middle East · Saudi Arabia · Government & Public Sector, Critical Infrastructure, General Enterprise · effective

effective

Minimum cybersecurity requirements for Saudi government organizations and critical national infrastructure operators, covering governance, defense, resilience, cloud, third parties, and ICS.

Governance Risk Management Third-Party Risk Cloud Security Industrial Control Systems Evidence implicit SBOM relevance Framework

Select

Saudi NCA Critical Systems Cybersecurity Controls

Middle East · Saudi Arabia · Government & Public Sector, Critical Infrastructure · effective

effective

Saudi critical systems controls extending the ECC for national critical systems across governance, defense, resilience, and third-party/cloud cybersecurity.

Critical Infrastructure Third-Party Risk Cloud Security Resilience Evidence implicit SBOM relevance Framework

Select

UNECE UN Regulation No. 155 Cybersecurity Management System

Global · UNECE Contracting Parties · Automotive & Mobility · effective

effective

Vehicle type approval regulation requiring cybersecurity management systems and risk controls across vehicle lifecycle and supply chain.

Primary provision UN Regulation No. 155, cybersecurity management system Cyber Security Management System

Secure Development Supply Chain Security Vulnerability Management Risk Management Evidence Audit Trail implicit SBOM relevance Regulation

Select

UNECE UN Regulation No. 156 Software Update Management System

Global · UNECE Contracting Parties · Automotive & Mobility · effective

effective

Vehicle type approval regulation for software update management systems, including safe and secure software update processes and update documentation.

Primary provision UN Regulation No. 156, software update management system Software Update Management System

Secure Updates Change Management Technical Documentation Evidence Audit Trail implicit SBOM relevance Regulation

Select

Auto-ISAC SBOM Best Practices

Global · International · Automotive & Mobility · guidance

guidance

Automotive industry guidance on SBOM program design, supplier exchange, vulnerability operations, confidentiality, and automation across OEM and multi-tier supplier ecosystems.

Primary provision Auto-ISAC SBOM Informational Report, automotive SBOM use automation is essential to SBOM adoption

SBOM Supplier Risk Vulnerability Management Software Transparency Secure Sharing Evidence explicit SBOM relevance Guidance

Select

IMDRF SBOM for Medical Device Cybersecurity

Global · IMDRF Members · Healthcare & Life Sciences · guidance

guidance

International regulator guidance on SBOM principles and practices for medical device cybersecurity across manufacturers, healthcare providers, and other stakeholders.

Primary provision IMDRF N73 SBOM principles and practices for medical device cybersecurity Software Bill of Materials for Medical Device Cybersecurity

SBOM Vulnerability Management Software Transparency Post-Market Monitoring Evidence explicit SBOM relevance Guidance

Select

CISA and International Partners Shared Vision for SBOM

Global · International · Software & Digital Services, Critical Infrastructure, Government & Public Sector · guidance

guidance

Joint international guidance setting a shared vision for SBOM as a core tool for vulnerability management, secure-by-design development, and software supply chain transparency.

Primary provision CISA and international partners shared vision for SBOM Software Bill of Materials

SBOM Software Transparency Vulnerability Management Secure Development Supply Chain Security explicit SBOM relevance Guidance

Select

IEC 62443-4-1 Secure Product Development Lifecycle

Global · International · Industrial & Manufacturing, Critical Infrastructure · effective

effective

Industrial automation and control system standard defining secure product development lifecycle practices for component suppliers.

Primary provision IEC 62443-4-1, secure product development lifecycle requirements Secure product development lifecycle requirements

Secure Development Vulnerability Management Secure Updates Technical Documentation Evidence explicit SBOM relevance Standard

Select

IEC 62443-4-2 Technical Security Requirements for IACS Components

Global · International · Industrial & Manufacturing, Critical Infrastructure · effective

effective

Component-level security standard for industrial control system products, covering embedded devices, host devices, network devices, and software applications.

Primary provision IEC 62443-4-2, IACS component technical security requirements Technical security requirements for IACS components

Product Security Secure Development Vulnerability Management Technical Documentation Evidence implicit SBOM relevance Standard

Select

IEC 62443-2-1 IACS Security Program Requirements

Global · International · Industrial & Manufacturing, Critical Infrastructure · effective

effective

Program-level industrial automation security management standard for asset owners operating control systems and OT environments.

Primary provision IEC 62443-2-1, IACS security program IACS security program

Risk Management Governance Vulnerability Management Supplier Risk Evidence implicit SBOM relevance Standard

Select

IEC 62443-3-3 System Security Requirements and Security Levels

Global · International · Industrial & Manufacturing, Critical Infrastructure · effective

effective

Industrial control system security standard defining system security requirements and target security levels for zones and conduits.

Primary provision IEC 62443-3-3, system security requirements and security levels System security requirements and security levels

Risk Management Product Security Access Control Monitoring Evidence adjacent SBOM relevance Standard

Select

ISO/IEC 27001 Information Security Management Systems

Global · International · General Enterprise, Software & Digital Services · effective

effective

International information security management system standard used as a baseline for governance, risk treatment, supplier controls, and audit evidence.

Primary provision ISO/IEC 27001:2022, information security management systems information security management systems

Governance Risk Management Supplier Risk Evidence Audit Trail adjacent SBOM relevance Standard

Select

ISO/IEC 27002 Information Security Controls

Global · International · General Enterprise, Software & Digital Services · effective

effective

Reference control catalogue for information security controls, including supplier relationships, secure development, vulnerability management, and asset management.

Primary provision ISO/IEC 27002:2022, information security controls information security controls

Risk Management Supplier Risk Secure Development Vulnerability Management Evidence adjacent SBOM relevance Standard

Select

ISO/IEC 27036 Supplier Relationship Security

Global · International · General Enterprise, Software & Digital Services · effective

effective

Supplier relationship security standard family covering information security risks in ICT supplier and acquirer relationships.

Primary provision ISO/IEC 27036 supplier relationships information security for supplier relationships

Supplier Risk Third-Party Risk Procurement Security Evidence Governance implicit SBOM relevance Standard

Select

ISO/IEC 27034 Application Security

Global · International · Software & Digital Services · effective

effective

Application security standard family for integrating security controls into application lifecycle and organizational governance.

Primary provision ISO/IEC 27034 application security application security

Secure Development Risk Management Technical Documentation Evidence adjacent SBOM relevance Standard

Select

ISO/IEC 42001 AI Management System

Global · International · AI & Data, Software & Digital Services · effective

effective

AI management system standard for organizations providing or using AI systems, supporting governance, risk controls, and lifecycle evidence.

Primary provision ISO/IEC 42001, artificial intelligence management system artificial intelligence management system

AI Governance Risk Management Technical Documentation Monitoring Evidence adjacent SBOM relevance Standard

Select

NIST IR 8536 Supply Chain Traceability Principles

North America · United States · Software & Digital Services, Industrial & Manufacturing, Critical Infrastructure · guidance

guidance

Final NIST report on verifiable supply-chain traceability, including software build provenance and component inventories. Its software procurement example links artifacts to attested build environments and upstream open-source components. Lifecycle guidance records firmware updates and component substitutions to support vulnerability response. The report is a conceptual framework, not a regulatory standard or compliance mandate.

Primary provision NIST IR 8536 (final, 9 September 2026), Sections 1.3, 3.3 Principle 3 (Software Supply Chain and Build Provenance example, p. 20), 3.6 Principle 6 (Firmware Updates and Continuous SCRM example, p. 24) connecting software artifacts to attested, secure build environments and upstream open-source components using interoperable standards

Supply Chain Security Technical Documentation Vulnerability Management implicit SBOM relevance Guidance

Select

NIST SP 800-218 Secure Software Development Framework

North America · United States · Government & Public Sector, Software & Digital Services · guidance

guidance

US secure software development framework used by federal software supply chain policy and procurement assurance programs.

Primary provision NIST SP 800-218, PO.1.3 and PS/PW/RV practice groups Secure Software Development Framework

Secure Development SBOM Vulnerability Management Evidence Attestation explicit SBOM relevance Guidance

Select

NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management

North America · United States · Government & Public Sector, Critical Infrastructure, Software & Digital Services · guidance

guidance

Cybersecurity supply chain risk management guidance for federal systems and organizations, covering suppliers, products, services, and system components.

Primary provision NIST SP 800-161 Rev. 1, C-SCRM controls and practices Cybersecurity Supply Chain Risk Management Practices

Supplier Risk Supply Chain Security SBOM Risk Management Evidence explicit SBOM relevance Guidance

Select

NIST Cybersecurity Framework 2.0

Global · International · General Enterprise, Critical Infrastructure · guidance

guidance

Cybersecurity risk management framework organized around govern, identify, protect, detect, respond, and recover outcomes.

Primary provision NIST CSF 2.0, GV.SC cybersecurity supply chain risk management cybersecurity supply chain risk management

Governance Risk Management Supplier Risk Vulnerability Management Evidence implicit SBOM relevance Framework

Select

NIST SP 800-53 Rev. 5 System and Services Acquisition Controls

North America · United States · Government & Public Sector, Software & Digital Services · guidance

guidance

Federal security and privacy control catalogue with acquisition, supply chain, developer testing, and flaw remediation controls.

Primary provision NIST SP 800-53 Rev. 5, SA and SR control families Security and Privacy Controls

Supplier Risk Secure Development Vulnerability Management Evidence Audit Trail implicit SBOM relevance Framework

Select

CISA NTIA Minimum Elements for SBOM

Global · International · Software & Digital Services, Government & Public Sector · guidance

guidance

Baseline SBOM guidance defining minimum data fields, automation support, and practices for generating, sharing, and using SBOMs.

Primary provision NTIA minimum elements for SBOM minimum elements for a Software Bill of Materials

SBOM Software Transparency Supplier Risk Vulnerability Management Evidence explicit SBOM relevance Guidance

Select

CISA 2025 Minimum Elements for SBOM

Global · United States / International · Software & Digital Services, Government & Public Sector, Critical Infrastructure · guidance

guidance

CISA update to the SBOM minimum elements baseline, reflecting the current state of maturity in software transparency and supply chain security and expanding expected SBOM capabilities.

Primary provision CISA 2025 Minimum Elements for a Software Bill of Materials current state of maturity

SBOM Software Transparency Vulnerability Management Supplier Risk Evidence explicit SBOM relevance Guidance

Select

CISA Joint Coordinated Vulnerability Disclosure Program Guidance

Global · United States / International · Software & Digital Services, Connected Products & IoT, Critical Infrastructure · guidance

guidance

Joint CISA, NSA, JPCERT/CC, NCSC-NL, and NCSC-UK guidance for software suppliers and online service providers to establish coordinated vulnerability disclosure programs with clear reporting paths, researcher communication, triage, remediation, and disclosure processes.

Primary provision CISA joint guide, Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers Coordinated Vulnerability Disclosure Program

Vulnerability Disclosure Vulnerability Management CVE Assignment security.txt SSVC Safe Harbor Supplier Communication Evidence adjacent SBOM relevance Guidance

Select

CISA Vulnerability Exploitability eXchange Status Justifications

Global · International · Software & Digital Services, Critical Infrastructure · guidance

guidance

Guidance for communicating whether a known vulnerability affects a product, reducing false positives in SBOM-driven vulnerability operations.

Primary provision CISA VEX status justifications Vulnerability Exploitability eXchange

VEX Vulnerability Management Software Transparency Evidence Supplier Communication explicit SBOM relevance Guidance

Select

CISA Known Exploited Vulnerabilities Catalog

Global · International · Critical Infrastructure, Software & Digital Services, Government & Public Sector · guidance

guidance

Catalog of vulnerabilities known to be exploited in the wild, used for prioritized remediation and risk-based vulnerability management.

Primary provision CISA KEV catalog Known Exploited Vulnerabilities Catalog

Vulnerability Management Remediation Evidence Incident Response adjacent SBOM relevance Guidance

Select

CISA Secure by Design Guidance

Global · International · Software & Digital Services, Connected Products & IoT · guidance

guidance

Secure by Design guidance urging technology manufacturers to make secure product development and vulnerability handling core business practices.

Primary provision CISA Secure by Design Secure by Design

Secure Development Vulnerability Disclosure Secure Defaults Evidence Governance implicit SBOM relevance Guidance

Select

SLSA Supply-chain Levels for Software Artifacts

Global · International · Software & Digital Services · guidance

guidance

Open framework for improving build integrity and provenance across software supply chains, from source through build and distribution.

Primary provision SLSA v1.0 software supply chain integrity framework Supply-chain Levels for Software Artifacts

Build Provenance Secure Development Supply Chain Security Evidence Attestation adjacent SBOM relevance Framework

Select

OpenSSF Scorecard

Global · International · Software & Digital Services · guidance

guidance

Open-source project health and security scoring tool used to evaluate dependency risk signals across source repositories.

Primary provision OpenSSF Scorecard project security checks automated security tool

Supplier Risk Open Source Risk Secure Development Evidence adjacent SBOM relevance Framework

Select

OWASP Software Component Verification Standard

Global · International · Software & Digital Services · guidance

guidance

OWASP verification standard for software components and supply chain controls, including inventory, integrity, provenance, and vulnerability practices.

Primary provision OWASP Software Component Verification Standard Software Component Verification Standard

SBOM Supply Chain Security Secure Development Vulnerability Management Evidence explicit SBOM relevance Framework

Select

CycloneDX SBOM Standard

Global · International · Software & Digital Services · guidance

guidance

Machine-readable bill of materials standard supporting SBOM, SaaSBOM, VEX, CBOM, and other software supply chain transparency use cases.

Primary provision CycloneDX bill of materials standard full-stack Bill of Materials standard

SBOM VEX Software Transparency Vulnerability Management Evidence explicit SBOM relevance Standard

Select

CycloneDX Cryptography Bill of Materials (CBOM)

Global · International · Software & Digital Services, Critical Infrastructure, General Enterprise · guidance

guidance

CycloneDX CBOM capability for representing cryptographic assets, relationships, algorithms, keys, certificates, and dependencies to support cryptographic risk and post-quantum readiness.

Primary provision CycloneDX Cryptography Bill of Materials capability algorithms, keys, certificates

CBOM Cryptographic Inventory Cryptographic Agility PQC Readiness Supply Chain Security Evidence explicit SBOM relevance Standard

Select

NIST SP 1800-38B Quantum Readiness: Cryptographic Discovery

North America · United States · Government & Public Sector, Critical Infrastructure, General Enterprise · guidance

guidance

NIST NCCoE practice guide for cryptographic discovery during post-quantum migration, including testing discovery tools and building inventory architecture.

Primary provision NIST SP 1800-38B, Quantum Readiness: Cryptographic Discovery Quantum Readiness: Cryptographic Discovery

CBOM Cryptographic Discovery Cryptographic Inventory PQC Readiness Risk Management Evidence adjacent SBOM relevance Guidance

Select

SPDX ISO/IEC 5962 Software Bill of Materials Standard

Global · International · Software & Digital Services · effective

effective

ISO-standardized SBOM and software package data exchange format used for component, license, security, and provenance transparency.

Primary provision SPDX specification and ISO/IEC 5962 Software Package Data Exchange

SBOM Software Transparency License Compliance Provenance Evidence explicit SBOM relevance Standard

Select

FedRAMP Rev. 5 Cloud Security Authorization

North America · United States · Government & Public Sector, Software & Digital Services · effective

effective

Federal cloud security authorization baseline based on NIST SP 800-53 Rev. 5 controls, including supply chain, vulnerability, and configuration evidence.

Primary provision FedRAMP Rev. 5 security authorization baseline Rev. 5 baselines

Cloud Security Vulnerability Management Supplier Risk Evidence Continuous Monitoring implicit SBOM relevance Framework

Select

DoD Cybersecurity Maturity Model Certification 2.0

North America · United States · Government & Public Sector, Software & Digital Services · phased

phased

DoD contractor cybersecurity certification program for protecting federal contract information and controlled unclassified information.

Primary provision DoD CMMC program Cybersecurity Maturity Model Certification

Governance Access Control Incident Response Supplier Risk Evidence adjacent SBOM relevance Certification

Select

DFARS 252.204-7012 Safeguarding Covered Defense Information

North America · United States · Government & Public Sector, Software & Digital Services · effective

effective

Defense acquisition clause requiring safeguarding of covered defense information and cyber incident reporting by contractors.

Primary provision DFARS 252.204-7012 cyber incident reporting Safeguarding Covered Defense Information

Incident Reporting Supplier Risk Evidence Access Control Vulnerability Management adjacent SBOM relevance Regulation

Select

TSA Pipeline Cybersecurity Security Directives

North America · United States · Critical Infrastructure · effective

effective

Transportation Security Administration cybersecurity directives for critical pipeline owners and operators after major ransomware events.

Primary provision TSA pipeline cybersecurity requirements critical pipeline owners and operators

Incident Reporting Vulnerability Management Operational Resilience Critical Infrastructure Evidence adjacent SBOM relevance Regulation

Select

TSA Rail and Aviation Cybersecurity Requirements

North America · United States · Critical Infrastructure · effective

effective

TSA cybersecurity requirements for designated passenger rail, freight rail, and airport and aircraft operators.

Primary provision TSA transportation cybersecurity requirements cybersecurity requirements for airport and aircraft operators

Incident Reporting Vulnerability Management Access Control Operational Resilience Evidence adjacent SBOM relevance Regulation

Select

EU Cybersecurity Act Certification Framework

Europe · European Union · Software & Digital Services, Connected Products & IoT, Critical Infrastructure · effective

effective

EU cybersecurity certification framework for ICT products, services, and processes, supporting conformity evidence used by other EU product rules.

Primary provision Regulation (EU) 2019/881 cybersecurity certification European cybersecurity certification framework

Certification Product Security Technical Documentation Evidence Risk Management adjacent SBOM relevance Regulation

Select

EU Cybersecurity Act 2 Proposal

Europe · European Union · Critical Infrastructure, Software & Digital Services, Government & Public Sector · proposed

proposed

European Commission proposal to revise the Cybersecurity Act and introduce a trusted ICT supply chain security framework for risks from high-risk suppliers and third-country dependencies.

Primary provision Proposal for a Regulation for the EU Cybersecurity Act, trusted ICT supply chain security framework trusted ICT supply chain

Trusted ICT Supply Chain Supplier Risk Certification Product Security Evidence adjacent SBOM relevance Proposal

Select

EU eIDAS 2 European Digital Identity Regulation

Europe · European Union · Software & Digital Services, Government & Public Sector · effective

effective

EU digital identity and trust services regulation expanding wallet, trust service, and assurance requirements for digital identity infrastructure.

Primary provision Regulation (EU) 2024/1183 European Digital Identity Framework European Digital Identity Framework

Identity Assurance Product Security Technical Documentation Certification Evidence adjacent SBOM relevance Regulation

Select

EU Medical Device Regulation Cybersecurity Expectations

Europe · European Union · Healthcare & Life Sciences · effective

effective

EU medical device framework requiring safety, performance, technical documentation, risk management, and post-market surveillance for software-enabled devices.

Primary provision Regulation (EU) 2017/745 medical devices medical devices

Risk Management Technical Documentation Post-Market Monitoring Vulnerability Management Evidence implicit SBOM relevance Regulation

Select

EU In Vitro Diagnostic Regulation Cybersecurity Expectations

Europe · European Union · Healthcare & Life Sciences · effective

effective

EU in vitro diagnostic medical device framework covering software-enabled diagnostics, technical documentation, lifecycle risk, and post-market evidence.

Primary provision Regulation (EU) 2017/746 in vitro diagnostic medical devices in vitro diagnostic medical devices

Risk Management Technical Documentation Post-Market Monitoring Vulnerability Management Evidence implicit SBOM relevance Regulation

Select

Germany BSIG and KRITIS Cybersecurity Requirements

Europe · Germany · Critical Infrastructure, Government & Public Sector · effective

effective

German IT security law and critical infrastructure obligations covering security measures, incident reporting, and evidence for operators and providers.

Primary provision BSI KRITIS cybersecurity requirements Critical Infrastructures

Critical Infrastructure Incident Reporting Risk Management Supplier Risk Evidence implicit SBOM relevance Regulation

Select

Germany BSI C5 Cloud Computing Compliance Criteria Catalogue

Europe · Germany · Software & Digital Services, Government & Public Sector · guidance

guidance

BSI cloud security assurance catalogue used by cloud providers and customers for security, transparency, and audit-ready evidence.

Primary provision BSI C5 cloud computing criteria catalogue Cloud Computing Compliance Criteria Catalogue

Cloud Security Supplier Risk Vulnerability Management Evidence Audit Trail adjacent SBOM relevance Framework

Select

TISAX and ENX Vehicle Cybersecurity Assessment

Global · International · Automotive & Mobility · guidance

guidance

Automotive assessment and exchange ecosystem for information security and vehicle cybersecurity assurance across OEM and supplier relationships.

Primary provision ENX vehicle cybersecurity assessment Vehicle Cyber Security

Supplier Risk Product Security Secure Development Evidence Governance implicit SBOM relevance Framework

Select

France ANSSI SecNumCloud

Europe · France · Software & Digital Services, Government & Public Sector · guidance

guidance

French cloud security qualification framework for cloud service providers serving sensitive public and private sector workloads.

Primary provision ANSSI SecNumCloud qualification SecNumCloud

Cloud Security Supplier Risk Vulnerability Management Evidence Certification adjacent SBOM relevance Certification

Select

Italy National Cybersecurity Perimeter

Europe · Italy · Critical Infrastructure, Government & Public Sector · effective

effective

Italian national cybersecurity perimeter requiring security measures and notifications for essential ICT assets and services.

Primary provision ACN national cybersecurity perimeter Perimetro di sicurezza nazionale cibernetica

Critical Infrastructure Incident Reporting Supplier Risk Risk Management Evidence implicit SBOM relevance Regulation

Select

Malaysia Cyber Security Act 2024

Asia-Pacific · Malaysia · Critical Infrastructure, Government & Public Sector · effective

effective

Malaysian cybersecurity law establishing national critical information infrastructure duties, incident reporting, and cybersecurity service provider licensing.

Primary provision Malaysia Cyber Security Act 2024 Cyber Security Act 2024

Critical Infrastructure Incident Reporting Risk Management Supplier Risk Evidence implicit SBOM relevance Regulation

Select

Thailand Cybersecurity Act

Asia-Pacific · Thailand · Critical Infrastructure, Government & Public Sector · effective

effective

Thai cybersecurity law establishing national cybersecurity governance and requirements for critical information infrastructure organizations.

Primary provision Thailand Cybersecurity Act B.E. 2562 Cybersecurity Act

Critical Infrastructure Incident Response Risk Management Governance Evidence implicit SBOM relevance Regulation

Select

UAE Information Assurance Regulation

Middle East · United Arab Emirates · Government & Public Sector, Critical Infrastructure · effective

effective

UAE national information assurance controls for government and critical entities covering governance, risk, operations, and third-party security.

Primary provision UAE Information Assurance Regulation Information Assurance

Governance Risk Management Third-Party Risk Evidence Incident Response adjacent SBOM relevance Framework

Select

Qatar National Information Assurance Policy

Middle East · Qatar · Government & Public Sector, Critical Infrastructure · guidance

guidance

Qatar national information assurance baseline for protecting government and critical information systems.

Primary provision Qatar national information assurance materials National Cyber Security Agency

Governance Risk Management Third-Party Risk Evidence Incident Response adjacent SBOM relevance Framework

Select

Brazil BACEN Resolution 4,893 Cybersecurity and Cloud Outsourcing

Latin America · Brazil · Financial Services · effective

effective

Brazil Central Bank cybersecurity policy and cloud outsourcing requirements for financial institutions and payment institutions.

Primary provision BACEN Resolution CMN 4,893 cybersecurity policy

Cybersecurity Policy Third-Party Risk Cloud Security Incident Reporting Evidence implicit SBOM relevance Regulation

Select

Hong Kong HKMA TM-G-1 Technology Risk Management

Asia-Pacific · Hong Kong · Financial Services · guidance

guidance

HKMA supervisory guidance for authorized institutions managing technology risk, cyber resilience, outsourcing, and incident response.

Primary provision HKMA technology risk management guidance Technology Risk Management

Technology Risk Third-Party Risk Incident Response Vulnerability Management Evidence implicit SBOM relevance Guidance

Select

Taiwan Cyber Security Management Act

Asia-Pacific · Taiwan · Government & Public Sector, Critical Infrastructure · effective

effective

Taiwan cybersecurity law governing government agencies and specific non-government agencies, including security maintenance and incident reporting.

Primary provision Taiwan Cyber Security Management Act Cyber Security Management Act

Critical Infrastructure Incident Reporting Governance Risk Management Evidence implicit SBOM relevance Regulation

Select

APRA CPS 234 Information Security

Asia-Pacific · Australia · Financial Services · effective

effective

Information security standard requiring APRA-regulated entities to manage information security capability, controls, incidents, testing, audit, and third-party control assurance.

Information Security Incident Reporting Third-Party Risk Control Assurance Audit Trail implicit SBOM relevance Standard

Select

NERC CIP-013 Supply Chain Risk Management

North America · United States, Canada · Critical Infrastructure · effective

effective

Reliability standard requiring covered electric-sector entities to identify and manage cybersecurity risks from vendors and supply chain relationships.

Supplier Risk Supply Chain Security Access Control Change Management Evidence Audit Trail implicit SBOM relevance Standard

Select

China Network Product Security Vulnerability Management Provisions

Asia-Pacific · China · Software & Digital Services, Connected Products & IoT · effective

effective

Rules governing discovery, reporting, repair, and publication of security vulnerabilities in network products including hardware and software.

Primary provision China network product security vulnerability management provisions network product security vulnerabilities

Vulnerability Disclosure Vulnerability Management Product Security Incident Reporting Evidence implicit SBOM relevance Regulation

Select

India CERT-In Cyber Security Directions

Asia-Pacific · India · General Enterprise, Software & Digital Services · effective

effective

CERT-In directions requiring covered entities to report specified cyber incidents rapidly and maintain relevant logs and security practices.

Incident Reporting Logging Evidence Vulnerability Management Governance adjacent SBOM relevance Regulation

Select

OMB M-23-02 Migrating to Post-Quantum Cryptography

North America · United States · Government & Public Sector, Critical Infrastructure, General Enterprise · effective

effective

OMB memorandum directing federal agencies to prepare for post-quantum cryptography by inventorying cryptographic systems, prioritizing high-value and high-impact assets, and assessing migration funding.

Primary provision OMB M-23-02, Section II prioritized inventory of cryptographic systems prioritized inventory of cryptographic systems

CBOM Cryptographic Inventory PQC Readiness Risk Management Evidence Migration Planning adjacent SBOM relevance Policy

Select

US FDA Cybersecurity in Medical Devices

North America · United States · Healthcare & Life Sciences · effective

effective

FDA cybersecurity expectations for medical device submissions and postmarket lifecycle management, including software component transparency and vulnerability management.

Primary provision FD&C Act Section 524B(b)(3) provide a software bill of materials

SBOM Vulnerability Management Coordinated Vulnerability Disclosure Secure Development Evidence Post-Market Monitoring explicit SBOM relevance Regulation

Select

RBI Outsourcing of IT Services Directions

Asia-Pacific · India · Financial Services · effective

effective

RBI directions for regulated entities outsourcing IT services, covering governance, risk management, confidentiality, business continuity, audit, and third-party oversight.

Third-Party Risk Supplier Risk Business Continuity Audit Trail Evidence Governance implicit SBOM relevance Regulation

Select

US SEC Cybersecurity Disclosure Rule

North America · United States · General Enterprise, Financial Services · effective

effective

Requires public companies to disclose material cybersecurity incidents and annually describe cybersecurity risk management, strategy, governance, and oversight.

Primary provision SEC cybersecurity risk management, strategy, governance, and incident disclosure rule material cybersecurity incidents

Incident Reporting Governance Risk Management Evidence Audit Trail adjacent SBOM relevance Regulation

Select

Canada OSFI Guideline B-13 Technology and Cyber Risk Management

North America · Canada · Financial Services · effective

effective

OSFI guidance setting expectations for federally regulated financial institutions to manage technology and cyber risks, including incident reporting and resilience.

Technology Risk Incident Reporting Governance Resilience Testing Evidence implicit SBOM relevance Regulation

Select

MAS Technology Risk Management Notice

Asia-Pacific · Singapore · Financial Services · effective

effective

MAS technology risk obligations for payment service providers, including fast notification of relevant incidents and controls over technology operations.

Incident Reporting Technology Risk Governance Evidence Operational Resilience adjacent SBOM relevance Guidance

Select

US EO 14028 and Federal Secure Software Attestation

North America · United States · Government & Public Sector, Software & Digital Services · effective

effective

Federal software supply chain policy requiring software producers serving the US government to attest to secure development practices, with SBOMs and artifacts used by agencies as supporting evidence.

Primary provision Executive Order 14028, Section 4(e)(vii) providing a purchaser a Software Bill of Materials

Secure Development SBOM Vulnerability Disclosure Evidence Attestation Supply Chain Security explicit SBOM relevance Regulation

Select

UK Product Security and Telecommunications Infrastructure Regime

Europe · United Kingdom · Connected Products & IoT · effective

effective

UK consumer connectable product security regime requiring manufacturers, importers, and distributors to meet minimum security requirements and provide statements of compliance.

Primary provision UK PSTI product security regime, security requirements for connectable products statement of compliance

Product Security Vulnerability Disclosure Technical Documentation Conformity Evidence Secure Defaults adjacent SBOM relevance Regulation

Select

Canada OSFI Guideline B-10 Third-Party Risk Management

North America · Canada · Financial Services · effective

effective

OSFI third-party risk guidance requiring federally regulated financial institutions to manage risks across outsourced and other third-party arrangements.

Third-Party Risk Supplier Risk Operational Resilience Audit Trail Evidence implicit SBOM relevance Regulation

Select

EU NIS2 Directive

Europe · European Union · Critical Infrastructure, Software & Digital Services, Government & Public Sector · effective

effective

EU-wide cybersecurity framework for essential and important entities, including risk management, incident reporting, supervision, and supply chain security measures.

Primary provision Directive (EU) 2022/2555, Article 21 supply chain security security in network and information systems acquisition, development and maintenance

Risk Management Incident Reporting Supply Chain Security Supplier Risk Governance Evidence implicit SBOM relevance Directive

Select

China Network Data Security Management Regulation

Asia-Pacific · China · AI & Data, Software & Digital Services, General Enterprise · effective

effective

Chinese network data security regulation requiring data processors to implement protection measures and report network product or service security defects and vulnerabilities.

Vulnerability Disclosure Incident Reporting Data Security Risk Assessment Product Security implicit SBOM relevance Regulation

Select

EU Digital Operational Resilience Act (DORA)

Europe · European Union · Financial Services, Software & Digital Services · effective

effective

Operational resilience regime for financial entities covering ICT risk management, major incident reporting, resilience testing, information sharing, and ICT third-party risk.

Primary provision Regulation (EU) 2022/2554, ICT third-party risk management manage ICT third-party risk as an integral component of ICT risk

Supplier Risk Incident Reporting Operational Resilience Evidence Audit Trail Third-Party Risk implicit SBOM relevance Regulation

Select

Japan JC-STAR IoT Product Security Scheme

Asia-Pacific · Japan · Connected Products & IoT, Critical Infrastructure · phased

phased

Japanese IoT product security conformity assessment scheme with baseline and higher assurance labels intended to support procurement and international alignment.

IoT Labeling Product Security Secure Updates Vulnerability Management Conformity Evidence adjacent SBOM relevance Certification

Select

PCI DSS v4.0.1 Software Component Inventory

Global · Payment Card Industry · Financial Services, Software & Digital Services · effective

effective

PCI DSS v4.0.1 Requirement 6.3.2 requires entities to maintain an inventory of bespoke and custom software and third-party software components incorporated into that software to support vulnerability and patch management.

Primary provision PCI DSS v4.0.1 Requirement 6.3.2 and testing procedures 6.3.2.a-b inventory of bespoke and custom software

SBOM Software Component Inventory Vulnerability Management Patch Management Secure Development Evidence explicit SBOM relevance Standard

Select

EU Radio Equipment Directive Cybersecurity Delegated Regulation

Europe · European Union · Connected Products & IoT · phased

phased

Activates cybersecurity, privacy, and fraud-protection essential requirements for categories of internet-connected radio equipment under the Radio Equipment Directive.

Primary provision Delegated Regulation (EU) 2022/30, Article 3 internet-connected radio equipment does not harm the network or its functioning

Product Security Vulnerability Management Secure Development Technical Documentation Conformity Evidence adjacent SBOM relevance Regulation

Select

EU Data Act Cloud Switching and Interoperability

Europe · European Union · Software & Digital Services, General Enterprise · phased

phased

EU data access and cloud switching regulation affecting data processing services, interoperability, switching, and contractual transparency.

Primary provision Regulation (EU) 2023/2854 Data Act switching between data processing services

Cloud Portability Technical Documentation Supplier Risk Governance Evidence adjacent SBOM relevance Regulation

Select

Switzerland Cyberattack Reporting for Critical Infrastructure

Europe · Switzerland · Critical Infrastructure, General Enterprise · effective

effective

Swiss cyberattack reporting obligation for operators of critical infrastructure with phased enforcement and notification duties.

Primary provision NCSC cyberattack reporting obligation Reporting obligation for cyberattacks

Incident Reporting Critical Infrastructure Evidence Risk Management Supplier Risk adjacent SBOM relevance Regulation

Select

Singapore Cybersecurity Act

Asia-Pacific · Singapore · Critical Infrastructure, Software & Digital Services · phased

phased

Cybersecurity framework for critical information infrastructure, expanded by 2024 amendments to cover additional classes such as foundational digital infrastructure providers.

Critical Infrastructure Incident Reporting Cybersecurity Codes Governance Evidence implicit SBOM relevance Regulation

Select

China GB 44495 and GB 44496 Vehicle Cybersecurity Standards

Asia-Pacific · China · Automotive & Mobility · effective

effective

Mandatory Chinese vehicle cybersecurity and software update standards covering CSMS-style governance, technical controls, inspection and test methods, software update management, and vehicle evidence.

Cybersecurity Management System Secure Updates Vulnerability Management Product Security Technical Documentation Evidence implicit SBOM relevance Standard

Select

OMB Memorandum M-26-05 Risk-Based Software and Hardware Security

North America · United States · Government & Public Sector, Software & Digital Services · effective

effective

Federal policy shifting software and hardware security assurance from universal attestation to agency risk-based contractual and validation approaches.

Primary provision OMB M-26-05, software and hardware security validation provide a current software bill of materials

Risk Management Secure Development SBOM Supplier Risk Evidence Procurement Security explicit SBOM relevance Policy

Select

UK GB Type Approval R155 and R156 Requirements

Europe · United Kingdom · Automotive & Mobility · phased

phased

Great Britain type approval implementation of UN R155 cybersecurity and UN R156 software update requirements, with phased dates for new vehicle types, complete vehicles, completed vehicles, and special purpose vehicles.

Cybersecurity Management System Secure Updates Supplier Risk Technical Documentation Evidence Audit Trail implicit SBOM relevance Standard

Select

APRA CPS 230 Operational Risk Management

Asia-Pacific · Australia · Financial Services · effective

effective

APRA standard requiring regulated entities to manage operational risks, maintain critical operations through disruption, and manage service-provider arrangements.

Operational Resilience Third-Party Risk Supplier Risk Business Continuity Evidence adjacent SBOM relevance Standard

Select

China Cybersecurity Label Management Measures

Asia-Pacific · China · Connected Products & IoT · upcoming

upcoming

China cybersecurity labeling framework for internet-connected products, including security capability levels, testing, reports, conformity statements, and vulnerability handling.

IoT Labeling Product Security Vulnerability Management Conformity Evidence Technical Documentation adjacent SBOM relevance Certification

Select

EU AI Act

Europe · European Union · AI & Data, Software & Digital Services, Healthcare & Life Sciences · phased

phased

Risk-based AI regulation requiring technical documentation, logging, post-market monitoring, incident reporting, and cybersecurity measures for high-risk AI systems.

Primary provision Regulation (EU) 2024/1689, Annex IV technical documentation technical documentation shall be drawn up before that system is placed on the market

Technical Documentation Incident Reporting Post-Market Monitoring Governance Evidence Risk Management adjacent SBOM relevance Regulation

Select

EU CRA Delegated Regulation on Delayed Notification Sharing

Europe · European Union · Software & Digital Services, Connected Products & IoT, Critical Infrastructure · effective

effective

Delegated CRA rule defining the cybersecurity-related grounds and conditions under which a CSIRT may delay dissemination of incident and vulnerability notifications through the CRA reporting ecosystem. It is an operational reporting rule alongside the CRA's 11 September 2026 reporting obligations.

Primary provision Commission Delegated Regulation (EU) 2026/881 supplementing Regulation (EU) 2024/2847, CRA Article 14(9) delaying the dissemination of notifications

Incident Reporting Vulnerability Disclosure Regulatory Reporting Supply Chain Security Evidence adjacent SBOM relevance Delegated Regulation

Select

US Executive Order on Defense Supply Chain BOM and Critical Materials

North America · United States · Government & Public Sector, Critical Infrastructure, Industrial & Manufacturing · phased

phased

Executive Order directing defense acquisition supply chain mapping, domestic and allied sourcing for critical materials, and future implementing regulations requiring prime contractors and subcontractors to provide complete indentured Bill of Materials evidence from raw materials to delivered systems.

Primary provision Executive Order, Sec. 3(b)(i), critical supply chain mapping and illumination; Sec. 2, 10 U.S.C. 4872 waiver restrictions components, parts, equipment, software, and materials

Bill of Materials SBOM Supply Chain Mapping Supplier Risk Procurement Security Critical Materials Risk Mitigation Corrective Action Plans Evidence explicit SBOM relevance Executive Order

Select

EU Machinery Regulation

Europe · European Union · Industrial & Manufacturing · upcoming

upcoming

Updates EU machinery safety rules for connected and software-enabled machinery, including protection against corruption where safety functions depend on software or data.

Primary provision Regulation (EU) 2023/1230, Annex III 1.1.9 protection against corruption identify the software installed on it

Product Security Technical Documentation Risk Management Secure Updates Evidence adjacent SBOM relevance Regulation

Select

Singapore CSA Quantum-Safe Migration Milestones

Asia-Pacific · Singapore · Critical Infrastructure, Government & Public Sector, Software & Digital Services · guidance

guidance

CSA's 14 October 2026 advisory urges organisations exposed to quantum risk to plan early, favour quantum-ready software and services and build cryptographic agility. It reiterates Singapore's CII expectations in linked guidance: CIIO migration plans are due 31 March 2027, new CII procurement must include quantum-safe considerations from 1 January 2028, and CII migration must finish by 31 December 2031. Other organisations are encouraged to plan by end-2027 and complete migration by 2035. These are guidance and supervisory expectations, not a general statutory mandate.

Primary provision CSA advisory, Singapore's Quantum-Safe Migration Milestones and What You Can Do sections 1-6; linked CII guidance Sections 5-8 and FAQ 2 Other organisations exposed to quantum risks are encouraged to complete migration by 2035.

Cryptographic Inventory PQC Readiness Cryptographic Agility Procurement Security Supplier Risk Evidence implicit SBOM relevance Advisory

Select

Poland KSC 2.0 Implementation Guide

Europe · Poland · Critical Infrastructure, Software & Digital Services, Government & Public Sector · guidance

guidance

Non-binding NASK and Ministry of Digital Affairs implementation guide for Poland's effective KSC 2.0 law. It explains how essential and important entities should operationalize information-security management, incident procedures and statutory ICT supply-chain controls, including supplier risk, product and service quality, dependency monitoring, supported software updates and vulnerability remediation. In-scope entities existing when the amendment entered into force have until 3 April 2027 to implement duties and begin using S46.

Primary provision NASK and Ministry of Digital Affairs, KSC 2.0 practical guide, pages 43-44; KSC Act Article 8(1)(2)(e) and Article 8(2)(1)-(4); adaptation deadline 3 April 2027 Ustawa nakłada obowiązek zarządzania ryzykiem związanym z dostawcami produktów, usług i procesów ICT.

Risk Management Supply Chain Security Supplier Risk Vulnerability Management Secure Updates Incident Reporting Procurement Security Evidence Audit implicit SBOM relevance Guidance

Select

EU Cyber Resilience Act (CRA)

Europe · European Union · Software & Digital Services, Connected Products & IoT, Industrial & Manufacturing · phased

phased

EU cybersecurity law for products with digital elements, with phased secure development, vulnerability handling and SBOM requirements. Manufacturer reporting duties have applied since 11 September 2026 through ENISA's operational Single Reporting Platform, including for products placed on the market before 11 December 2027. ENISA's 1 October 2026 version 1.4 glossary defines the product, component, version, mitigation and exploitation fields used at each reporting stage. Main product requirements and open-source software steward reporting apply from 11 December 2027. July 2026 non-binding guidance clarifies remote data processing and free and open source software scope.

Primary provision Regulation (EU) 2024/2847, Articles 14(2), 14(4), 16(1), 24(3), 71(2); Annex I Part II(1); ENISA CRA SRP Glossary version 1.4, common fields 1-18 and AEV fields v19-v30 (1 October 2026); ENISA SRP FAQ 4, 7, 9, 12-13 and 29; Commission guidance C(2026) 5252 Name of the software or hardware component in which the vulnerability or incident is located or observed.

SBOM Vulnerability Disclosure Incident Reporting Technical Documentation Secure Development Supply Chain Security explicit SBOM relevance Regulation

Product	Components	Compliance	Last Updated
Automotive Platform v2.3	1,247	98% UNECE R155	2024-12-19
Medical Device Suite	892	100% FDA	2024-12-18
Financial Services API	1,534	96% EO 14028	2024-12-17
IoT Gateway Firmware	2,103	99% EU CRA	2024-12-19

System of Record

Secure Exchange

SBOM Trust Center

MCP Server (API & Automation)

Architecture

Integrations

Engineering

Security

Compliance & Governance

Supplier & Ecosystem

FOSS License Risk

Community & Open Source

Free SBOM Scan

Free CRA Assessment

Free SBOM Management

Plans & Pricing

Start Free

Enterprise

Blog / Insights

SBOM Fundamentals

SBOM Regulations

Compare Platforms

Platform Datasheets

About

AI Lab

Partners

Events

Contact

System of Record

Secure Exchange

SBOM Trust Center

MCP Server (API & Automation)

Architecture

Integrations

Engineering

Security

Compliance & Governance

Supplier & Ecosystem

FOSS License Risk

Community & Open Source

Free SBOM Scan

Free CRA Assessment

Free SBOM Management

Plans & Pricing

Start Free

Enterprise

Blog / Insights

SBOM Fundamentals

SBOM Regulations

Compare Platforms

Platform Datasheets

About

AI Lab

Partners

Events

Contact

Map global software supply chain obligations

ISO/IEC 27090 AI Security Threats and Compromises

UK DWP Security Standard SS-003: Software Development

UK DWP Technical Vulnerability and Continuous Threat Exposure Management Security Policy

UK Government Functional Standard GovS 005: Digital

Japan Information Security Early Warning Partnership Guideline

Italy ACN NIS Implementation Vademecum

ENISA Healthcare Cybersecurity Procurement Guidelines

US FY2027 NDAA Artificial Intelligence Functional Bill of Materials (AIBOM)

CISA/G7 Software Bill of Materials for AI Minimum Elements

US CIRCIA Cyber Incident Reporting

US FCC Cyber Trust Mark

UK Network and Information Systems Regulations

UK PRA Operational Incident and Third-Party Reporting

UK Software Security Code of Practice

Australia Cyber Security Act 2024

Australia Security Standards for Smart Devices

Australia Security of Critical Infrastructure Act

Singapore CSA Advisory on Securing the Software Supply Chain

Singapore Government ICT&SS Software Supply Chain Controls

Canada Critical Cyber Systems Protection Act

Canadian Centre for Cyber Security Software Supply Chain Guidance

Japan Cyber Infrastructure Provider Guidelines

China Cybersecurity Law