Sorry, you need to enable JavaScript to visit this website.
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.

Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.

The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

  1. Home

NTIA Software Component Transparency

April 28, 2021

This site features information and resources for the ongoing Software Component Transparency effort around Software Bill of Materials (SBOM). For published stakeholder-drafted consensus documents on SBOM, please visit ntia.gov/SBOM.

SBOM Virtual Multistakeholder Meeting

Next meeting date: TBD

In January through April of 2021, NTIA hosted SBOM info sessions for the Energy and Bulk Power community, offering some background and more technical information around SBOM. Slides and videos are below:

For more information, or to join a working group, please email mdoscher@ntia.gov.

At the November 18 in-person meeting, following the publication of the first round of SBOM deliverables, stakeholders discussed how the activities identified as next steps should be divided among the existing working groups. Information on those working groups is below, along with some participation information. For more information or background, please email mdoscher@ntia.gov.

Framing Working group

Work will focus defining and refining the specification of SBOMs, with attention to obstacles to broader, more scalable adoption. Topics identified include: component identity and naming, how to share SBOMs, how to characterize non-exploitability vs. vulnerability, SBOM integrity and high assurance data, SBOMs for Cloud/SAAS, and others.
Working group call: Fridays, 2:00pm-3:00pm ET
Join the group: https://lists.sei.cmu.edu/mailman/listinfo/ntia-sbom-framing.

Awareness and Adoption

Work will focus on promoting SBOM as an idea and a practice. Tasks identified include: building a broader outreach strategy with outreach targets; shorter documents with specific outreach goals for sectors, organizational role, etc; coordinating with related efforts; more explicit business cases for SBOM adoption.
Working group call (tentative): Fridays, 1:00pm-2:00pm ET
Join the group: https://lists.sei.cmu.edu/mailman/listinfo/ntia-sbom-practices

Formats & Tooling

Working group will focus on how to automate SBOM production and use. Initial goals are to catalog existing tools for SBOMs in the different identified standards (SPDX, SWID, CycloneDX) and develop a translator between these formats. Further work will include a gap analysis in SBOM tools, and potentially explore SBOM processes and playbooks.
Working group call: Alternate Fridays, 11:00am-12:00pm ET
Join the group: https://lists.linuxfoundation.org/mailman/listinfo/ntia-sbom-formats

Healthcare Proof of Concept

Working group will plan and execute a second proof-of-concept exercise, with an expanded set of healthcare participants and the inclusion of IT and security industry partners. The group will also advise other industry players interested in SBOM demonstrations.
Working group call: Thursdays, 1:00pm-2:00pm ET
Join the group: https://lists.sei.cmu.edu/mailman/listinfo/ntia-sbom-healthcare

Prior Meetings

Meeting date: April 29

Meeting date: January 13

Meeting date: October 22

Meeting date: July 9, 2020  

Meeting date: April 15, 2020 

Meeting date: February 13, 2020

Meeting presentations:

Meeting date: November 18, 2019

Meeting presentations:

Meeting date: September 5, 2019

Drafts for review and discussion

Meeting date: June 27

Meeting Date: April 11, 2019

Meeting Documents:

Meeting Date: February 20, 2019

Meeting Date: November 6, 2018

NTIA Multistakeholder Process on Software Component Transparency progress update - October 1, 2018

At the July 19 kickoff meeting, several working groups were proposed. Information on those working groups is below. To participate, please email afriedman@ntia.doc.gov.

Understanding the Problem

Goal is to scope out the idea of software transparency and the problems it seeks to solve, including how SBOM data might be shared. Outputs might include useful terminology, issues and explicit decisions to address, and implementation guides.

Use Cases and State of Practice

Will focus on identifying use cases, current and possible future, where SW Bill of Materials or similar data is used to achieve various goals. Through review of the current state of practice, we will develop outputs that identify what works today and what are barriers to success.

Standards and Formats

Will investigate existing standards and initiatives as they apply to identifying the external components and shared libraries, commercial or open source, used in the construction of software products. The group will analyze efforts underway in the community and industry related to assuring this transparency is readily available in a machine-readable manner. 

Healthcare Proof of Concept

This will be a collaborative effort between healthcare delivery organizations and medical device manufacturers to establish a prototype SBOM format and exercise use cases for SBOM production and consumption. The goal is to demonstrate successful use of SBOMs and relate to the overall cross-sector effort to establish standardized formats and processes.

Meeting Date: July 19, 2018

NTIA’s next cybersecurity multi-stakeholder process will focus on Software Component Transparency. Participants will explore how manufacturers and vendors can communicate useful and actionable information about the third-party software components that comprise modern software and IoT devices, and how this data can be used by enterprises to foster better security decisions and practices. The first meeting, to be held on July 19, 2018, is intended to bring stakeholders together to share the range of views on software and IoT component transparency, and to establish desired stakeholder outcomes and a structure for this process. The goal of this initiative is to foster a market offering greater transparency to organizations, who can then integrate this data into their risk management approach.

For more information, or to receive updates about this initiative, please contact afriedman@ntia.doc.gov.

Background:

Since 2015, the National Telecommunications and Information Administration has sought public comment on several matters around cybersecurity, the Internet of Things, and the health of the digital ecosystem. Several themes emerged from these three public consultations. Many stakeholders emphasized the importance of community-led, consensus-driven, and risk-based solutions to address cybersecurity challenges, highlighting the role NTIA should play in convening multistakeholder processes. In the digital ecosystem, particular challenges were identified: understanding and handling vulnerability information, addressing the insecurities in the growing IoT marketplace, and fostering a secure development lifecycle. NTIA has convened two multistakeholder processes to address these challenges, one on vulnerability disclosure and another on IoT security updates.

Additional Information:

The Federal Register Notice announcing the first meeting and providing further background and detail

Assistant Secretary David Redl's blog post “NTIA Launches Initiative to Improve Software Component Transparency”

A report by the U.S. Department of Commerce and the U.S. Department of Homeland Security, “Enhancing the Resilience of the Internet and Communications Ecosystem Against Botnets and Other Automated, Distributed Threats”

Information about NTIA’s multistakeholder process on IoT security upgradability and patching: https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-iot-security

Information about NTIA’s multistakeholder process on vulnerability disclosure: https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-cybersecurity-vulnerabilities

Topics
Internet Policy Task Force
Cybersecurity
Internet of Things
Program
Internet Policy