Software Bill of Materials (SBOM): Supply Chain Transparency

SBOM provides transparency into software composition.

Why SBOM Matters

- Log4j showed hidden dependencies
- US Executive Order requirement
- Supply chain visibility
- Faster vulnerability response

SBOM Formats

- SPDX (Linux Foundation)
- CycloneDX (OWASP)
- SWID Tags (ISO standard)

Implementation

- Generate during CI/CD
- Store and version SBOMs
- Monitor for new CVEs
- Share with customers

Tools: Syft, Trivy, Grype, FOSSA, Snyk.