You are here

NTIA Software Component Transparency

October 19, 2020

SBOM Virtual Multistakeholder Meeting

Next meeting:  TBD

    For more information, or to join a working group, please email

    At the November 18 in-person meeting, following the publication of the first round of SBOM deliverables, stakeholders discussed how the activities identified as next steps should be divided among the existing working groups. Information on those working groups is below, along with some participation information. For more information or background, please email

    Framing Working group

    Work will focus defining and refining the specification of SBOMs, with attention to obstacles to broader, more scalable adoption. Topics identified include: component identity and naming, how to share SBOMs, how to characterize non-exploitability vs. vulnerability, SBOM integrity and high assurance data, SBOMs for Cloud/SAAS, and others.
    Working group call: Fridays, 2:00pm-3:00pm ET
    Join the group:

    Awareness and Adoption

    Work will focus on promoting SBOM as an idea and a practice. Tasks identified include: building a broader outreach strategy with outreach targets; shorter documents with specific outreach goals for sectors, organizational role, etc; coordinating with related efforts; more explicit business cases for SBOM adoption.
    Working group call (tentative): Fridays, 1:00pm-2:00pm ET
    Join the group:

    Formats & Tooling

    Working group will focus on how to automate SBOM production and use. Initial goals are to catalog existing tools for SBOMs in the different identified standards (SPDX, SWID, CycloneDX) and develop a translator between these formats. Further work will include a gap analysis in SBOM tools, and potentially explore SBOM processes and playbooks.
    Working group call: Alternate Fridays, 11:00am-12:00pm ET
    Join the group:

    Healthcare Proof of Concept

    Working group will plan and execute a second proof-of-concept exercise, with an expanded set of healthcare participants and the inclusion of IT and security industry partners. The group will also advise other industry players interested in SBOM demonstrations.
    Working group call: Thursdays, 1:00pm-2:00pm ET
    Join the group:

    Prior Meetings

    Meeting date: October 22

    Meeting date: July 9, 2020  

    Meeting date: April 15, 2020  

    Agenda for April 15 meeting

    Meeting date: February 13, 2020

    Meeting presentations:

    Meeting date: November 18, 2019 ​

    Meeting presentations:

    Meeting date: September 5, 2019 

    Drafts for review and discussion

    Meeting date: June 27

    Meeting Date: April 11, 2019

    Meeting Documents:

    Meeting Date: February 20, 2019

    Meeting Date: November 6, 2018

    October 1 update

    At the July 19 kickoff meeting, several working groups were proposed. Information on those working groups is below. To participate, please email

    Understanding the Problem

    Goal is to scope out the idea of software transparency and the problems it seeks to solve, including how SBOM data might be shared. Outputs might include useful terminology, issues and explicit decisions to address, and implementation guides.

    Use Cases and State of Practice

    Will focus on identifying use cases, current and possible future, where SW Bill of Materials or similar data is used to achieve various goals. Through review of the current state of practice, we will develop outputs that identify what works today and what are barriers to success.

    Standards and Formats

    Will investigate existing standards and initiatives as they apply to identifying the external components and shared libraries, commercial or open source, used in the construction of software products. The group will analyze efforts underway in the community and industry related to assuring this transparency is readily available in a machine-readable manner. 

    Healthcare Proof of Concept

    This will be a collaborative effort between healthcare delivery organizations and medical device manufacturers to establish a prototype SBOM format and exercise use cases for SBOM production and consumption. The goal is to demonstrate successful use of SBOMs and relate to the overall cross-sector effort to establish standardized formats and processes.

    Meeting Date: July 19, 2018

    NTIA’s next cybersecurity multistakeholder process will focus on Software Component Transparency. Participants will explore how manufacturers and vendors can communicate useful and actionable information about the third-party software components that comprise modern software and IoT devices, and how this data can be used by enterprises to foster better security decisions and practices.  The first meeting, to be held on July 19, 2018, is intended to bring stakeholders together to share the range of views on software and IoT component transparency, and to establish desired stakeholder outcomes and a structure for this process.  The goal of this initiative is to foster a market offering greater transparency to organizations, who can then integrate this data into their risk management approach.

    For more information, or to receive updates about this initiative, please contact


    Since 2015, the National Telecommunications and Information Administration has sought public comment on several matters around cybersecurity, the Internet of Things, and the health of the digital ecosystem. Several themes emerged from these three public consultations. Many stakeholders emphasized the importance of community-led, consensus-driven, and risk-based solutions to address cybersecurity challenges, highlighting the role NTIA should play in convening multistakeholder processes. In the digital ecosystem, particular challenges were identified: understanding and handling vulnerability information, addressing the insecurities in the growing IoT marketplace, and fostering a secure development lifecycle. NTIA has convened two multistakeholder processes to address these challenges, one on vulnerability disclosure and another on IoT security updates.

    Additional Information:

    The Federal Register Notice announcing the first meeting and providing further background and detail:

    Assistant Secretary David Redl's blog post “NTIA Launches Initiative to Improve Software Component Transparency

    A report by the U.S. Department of Commerce and the U.S. Department of Homeland Security, “Enhancing the Resilience of the Internet and Communications Ecosystem Against Botnets and Other Automated, Distributed Threats

    Information about NTIA’s multistakeholder process on IoT security upgradability and patching:

    Information about NTIA’s multistakeholder process on vulnerability disclosure: