What the Cyber Resilience Act asks of connected-device teams.
An SBOM is a list of what your software is made of. It sounds mundane, but under the EU Cyber Resilience Act it becomes something you have to keep, maintain and act on.
A Software Bill of Materials (SBOM) is an inventory of the components inside your product's software, open-source libraries, third-party modules and their versions, and how they relate to each other. Think of it as an ingredients list you can query.
Why the CRA effectively requires one
The CRA holds a manufacturer responsible for handling vulnerabilities across a product's whole supported lifetime. You cannot do that if you don't know what is inside the product. When a new vulnerability lands in a widely used library, an SBOM is what lets you answer, in minutes rather than weeks, "are we affected, and where?"
What a useful SBOM contains
- Every component and its exact version.
- The supplier or origin of each component.
- The dependency relationships between them.
- A format you can share and machine-read (CycloneDX or SPDX).
Getting started
Generate the SBOM from your build pipeline so it reflects what actually ships, regenerate it on every release so it never goes stale, and wire it into vulnerability tracking so a new CVE automatically flags the affected products. That last step is where an SBOM stops being paperwork and starts saving you time.
An SBOM is one piece of CRA readiness. To see the whole picture for your product, start with a compliance gap assessment.