Beyond the SBOM: What CISOs should about CBOMs and HBOMs

SBOMs, CBOMs and HBOMS -- oh my! Learn how these bills of materials help manage supply chain risk and assess which of the three your organization needs.

• Share this item with your network:

• Paul Kirvan
• Alissa Irei, Senior Site Editor

Heartbleed, SolarWinds and Log4j -- the stuff of CISOs' nightmares. As cybersecurity leaders know all too well, these historic, high-profile security breaches revealed massive weaknesses in supply-chain security.

Rising awareness of third-party risk has led to a surge of interest in the SBOM. Often compared to ingredient lists on packaged food, SBOMs provide security teams with information about the components in their software, helping them identify supply-chain vulnerabilities and risks.

But the SBOM isn't the only bill of materials that CISOs should consider for third-party risk management. This article introduces two important, adjacent concepts -- the cryptographic bill of materials (CBOM) and the hardware bill of materials (HBOM) -- as well as the ...