Re:Krita fund has 0 corporate support
by hiAndrewQuinn on Thursday October 05, 2023 @08:29AM
(#37777719)
Say more about this SBOM regulation. Do you have an EN standard or something you can point me to?
[ Parent
| on HN ]
Re:Krita fund has 0 corporate support
by kevinherron on Thursday October 05, 2023 @08:38AM
(#37777817)
It's mostly a recommendation from what I've seen so far, but it's not hard to read this as a future requirement.
CISA has been pushing it, which his my why it's on my radar: https://www.cisa.gov/sbom
FDA wants electronic SBOM for future device approvals.
https://www.fda.gov/medical-devices/digital-health-center-ex...
Re:Krita fund has 0 corporate support
by lars_francke on Thursday October 05, 2023 @10:19AM
(#37778940)
As others have already commented:
The US government has added SBOMs to a proposed rule to update the Federal Acquisition Regulation. So if you want to sell to the US Government you'll have to provide SBOMs: https://www.federalregister.gov/documents/2023/10/03/2023-21...
Lots of large companies require SBOMs from their supplier.
In the EU we will get the Cyber Resilience Act which will make them mandatory as well in certain cases: https://data.consilium.europa.eu/doc/document/ST-12536-2023-...
And yes, there's bascially two technical standards to provide them: SPDX and CycloneDX: https://cyclonedx.org/