[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-283376-105":53,"doc-detail-283376-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","software-bill-of-materials-sboms-robert-a-martin-removing-barriers-to-the-application-of-tooling-for-scrm-and-software-assurance","Software Bill of Materials (sBOMs) - Robert A. Martin - Removing Barriers to the Application of Tooling for SCRM and Software Assurance","","Software Bill of Materials (sBOMs) addresses how software-enabled systems and connected dependencies introduce risks through task dependency, supply chain, and information flow. The talk outlines why assurance must extend beyond one’s own systems to everything relied upon, highlights the opacity of the supply chain, and frames market transparency via SBOMs. It covers basics of SBOM, cross-sector use cases, guidance for using standards, including SWID and SPDX, and expected draft deliverables, plus example applications such as patch currency, automated response, and trusted component registries.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/software-bill-of-materials-sboms-robert-a-martin-removing-barriers-to-the-application-of-tooling-for-scrm-and-software-assurance/283376/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/software-bill-of-materials-sboms-robert-a-martin-removing-barriers-to-the-application-of-tooling-for-scrm-and-software-assurance/283376.png","ImageObject",442,249,{"name":88,"@type":89},"Finn","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-09-16",true,{"@type":98,"interactionType":99,"userInteractionCount":8},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"Why do software-enabled and connected systems increase cybersecurity risk?","Question",{"text":108,"@type":109},"They can be attackable or susceptible to hazards that propagate through task dependency, supply chain, or information flow. Subversion can come from vulnerabilities, misconfigurations, application weaknesses, counterfeit items, or tainted software or hardware.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What is the purpose of a Software Bill of Materials (sBOM)?",{"text":113,"@type":109},"An sBOM provides transparency into third-party components and supports documenting risk, enabling mitigations, and improving software development practices. It is intended to make component supply-chain information more observable across sectors.",{"name":115,"@type":106,"acceptedAnswer":116},"Which standards and identifiers are referenced for implementing SBOM?",{"text":117,"@type":109},"The presentation points to Software ID tags (SWID) and the Software Package Data Exchange (SPDX) as key standards/approaches for SBOM implementation.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},283376,1791733786,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":8,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},34359740700684,"https://ap-avatar.wpscdn.com/avatar/1f400023980c374ae676?_k=1777273430885731487","© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \nSoftware Bill of Materials (sBOMs)  \n(Removing Barriers to the application of tooling to C  \n-  \nSCRM and Software Assurance)  \nRobert A . Martin  \nSr. Secure Software & Technology Prin . Eng. Trust & Assurance Cyber Technologies Dept. Cyber Solutions Technical Center  \nPresented atthe DoD, DHS, NIST, and GSA sponsored Software and Supply Chain Assurance Forum hosted at MITRE McLean, VA  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \nEverything is Becoming Software-Enabled and Connected, Either through Task Dependency, Supply Chain, or Information Flow  \nToday Your System is:   \n• attackable or  \n• susceptible to a hazard…  \nWhen this Other System  gets subverted through:  \n• an un-patched vulnerability;  \n• a mis-configuration;  \n• an application weakness;  \n• a counterfeit item;  \n• tainted software or hardware; or  \n• the system’s susceptibility to a hazard…  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \nWe need to be assured that not only are our own systems trustworthy but also everything we depend upon…  \nThe Supply Chain for Software-Enabled Capabilities is Opaque  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \nMarket Transparency through “Software Bill of Materials”  \n• Third party components are a known systemic risk.  \n• Transparency can drive tools and behavior to document risk, support mitigations, and drive better SW development practices .  \n• NTIA at Commerce launched an open, community-driven, crosssector “multistakeholder process” to promote software component transparency.  \n• Understand the problem and define basics of SBOM  \n• Develop use cases across sectors on how such data can be used, today and in the future .  \n• Guidance on how to use existing standards to implement SBOM  \n• Software ID tags (SWID)  \n• Software Package Data Exchange (SPDX)  \n• Expected draft deliverables late spring 2019  \n• More info or to join: [afriedman@ntia.doc.gov](afriedman@ntia.doc.gov)  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \nUse Cases for sBOM  \nFormulation  \n(how it was compiled/formed)  \nAssurance  \n(trustworthiness of it)  \nsBOM of a Service (sBOM of sw delivering service)  \nPatch Currency  \n(known fixes are applied to it)  \nAutomated Response  \n(sBOM parsing/action)  \nAssured Mket Transp  \n(public DBs of components)  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45  \n© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45","cbCaisaYZcwplNd5","https://ap.wps.com/l/cbCaisaYZcwplNd5","pdf",12577654,38,"English","# Software Bill of Materials (sBOMs)\n## Why systems are at risk through dependencies\n## Market transparency through SBOM\n## Use cases for sBOM\n## SBOM basics and implementation standards","[{\"question\":\"Why do software-enabled and connected systems increase cybersecurity risk?\",\"answer\":\"They can be attackable or susceptible to hazards that propagate through task dependency, supply chain, or information flow. Subversion can come from vulnerabilities, misconfigurations, application weaknesses, counterfeit items, or tainted software or hardware.\"},{\"question\":\"What is the purpose of a Software Bill of Materials (sBOM)?\",\"answer\":\"An sBOM provides transparency into third-party components and supports documenting risk, enabling mitigations, and improving software development practices. It is intended to make component supply-chain information more observable across sectors.\"},{\"question\":\"Which standards and identifiers are referenced for implementing SBOM?\",\"answer\":\"The presentation points to Software ID tags (SWID) and the Software Package Data Exchange (SPDX) as key standards/approaches for SBOM implementation.\"}]","Software Bill of Materials (sBOMs) - Robert A. Martin - Removing Barriers to the Application of Tooling for SCRM and Software Assurance | PDF",1789601732,13]