Step 3: External SBOMs

The Role of Vendors in Your Security Ecosystem

Vendors and external suppliers play a significant role in an organization's security ecosystem, especially when their software is integrated into your products or systems. In many cases, vulnerabilities in third-party components can expose your organization to risks. Therefore, having a transparent relationship with vendors regarding the security of their products is crucial. Requesting SBOMs from vendors isn't just about compliance; it's a step towards fostering a culture of security and accountability in the software supply chain.

Strategies for Effective SBOM Acquisition and Management

Initiating the Conversation

One of the first strategies to obtain SBOMs from your vendors involves initiating a dialogue about software security and the importance of transparency. Just as consumers today wouldn't purchase food without a clear declaration of ingredients, we believe that, in the future, no organization will accept software without a detailed SBOM. By asking for an SBOM, you not only signal your commitment to security but also potentially catalyze an internal process within the vendor's organization, leading them towards creating more secure and transparent products.

Establishing SBOM Requests in Procurement Processes

Incorporate SBOM acquisition as a standard requirement in your procurement process. Make it clear to vendors that providing an SBOM is not optional but a necessary condition of doing business. This requirement should be communicated as part of the initial RFP (Request for Proposal) or contract negotiations to ensure vendors understand the expectation from the outset.

Collaborating for Quality Improvement

Encourage your vendors to view SBOM creation not as a mere regulatory hurdle but as an opportunity to enhance the quality of their software. Highlight how an SBOM can help them identify and remediate vulnerabilities within their components before they become a security liability. This approach not only benefits your organization by receiving more secure software but also helps vendors by improving their product quality and competitive edge in the market.

Providing Support and Resources

Recognize that not all vendors may have the resources or knowledge to generate an SBOM. Offer support by providing information on tools, best practices, and guidelines for SBOM generation. Sharing resources and knowledge can ease the transition for vendors and facilitate a smoother SBOM acquisition process.

Leveraging SBOMs for Continuous Improvement

Once received, integrate the SBOMs into your vulnerability management and risk assessment processes. Regularly review and update these documents to reflect any changes or updates in the software components. This continuous monitoring not only enhances your security posture but also ensures ongoing compliance and risk mitigation.

SBOM Observer for External SBOMs

By uploading the external SBOM to your own SBOM Observer namespace you can easily track each of your vendor's risk and see how it contributes to your total risk.

Read more about using SBOM Observer for supplier transparency

Next Step

Step 4: Analyzing Findings and Vulnerabilities covers the process of translating the transparency gained from SBOMs into actionable insights.