How to generate an SBOM (Software Bill of Materials) fast

Jan Pöschko
November 2, 2023

What is an SBOM?

A software bill of materials (SBOM) derives from the traditional use of a bill of materials (BOM) in manufacturing, which catalogs the raw materials and components of a product. An SBOM is a complete list of all the software components used in a product, including commercial off-the-shelf (COTS) and open-source components.
As software becomes increasingly integral to the operation of medical devices, regulatory agencies such as the FDA have recognized the need for transparency and traceability in the software supply chain. An SBOM is a key part of meeting these needs. Creating and maintaining an SBOM presents challenges because of the inherent amount of change in software and the huge number of dependencies modern software products use.

Who needs an SBOM?

Any organization involved in the development and distribution of software, especially in industries with regulatory oversight, can benefit from having an SBOM. However, medical device software manufacturers have a critical need for SBOMs due to the stringent regulations and safety requirements imposed by regulatory agencies such as the FDA.

The latest FDA guidance on cybersecurity in medical devices states that software manufacturers and other regulated organizations need an SBOM to meet regulatory requirements, ensure software transparency, and manage risks effectively. As of October 1, 2023, manufacturers’ submissions can be rejected by the FDA if an SBOM and a plan to monitor and respond to vulnerabilities is not included.

When to create a software bill of materials (SBOM)

You should incorporate SBOM generation as a standard practice throughout the entire software development lifecycle to ensure that the SBOM remains comprehensive, accurate, and aligned with the software being developed. Creating an SBOM early in the lifecycle allows better tracking and documentation of software components as they are integrated into the product.
Waiting to create an SBOM until later stages of development makes it difficult to identify all of the used components and their versions, especially if the development process has frequent updates or changes.

Are there open-source SBOM generators & SBOM Tools?

Yes, there are SBOM generators and tools available that can assist in the creation and management of the software bill of materials (SBOMs). However, while many of these tools claim to automate the SBOM management process, the truth is that there is still a large amount of manual intervention and configuration that falls on the development and compliance teams who use them.

Step by Step instructions to Create an SBOM and What’s Included

Medical device software manufacturers consistently lose time, and developers, adhering to cybersecurity-related documentation requirements. Why lose developers? Because this task is extremely tedious, time-consuming, and boring.

A typical SBOM cycle looks like this:

1. Proprietary, open-source software and other third-party components must be documented and updated with even small changes to any component.
How it's done: Development teams track down each component in their system and prepare for compilation into an SBOM.

2. Create a list of components: Once all components are identified, software teams compile the list into a traditional SBOM. Information must include the Component name, version number, software manufacturer, level of support provided by the software manufacturer, the end-of-support date, and any known vulnerabilities.
How it's done: Traditionally, developer teams achieve this task by manually copying and pasting into Excel spreadsheets or a siloed documentation tool.

3. Determine dependencies: The next step is to determine the dependencies between the components by identifying which components rely on others to function properly.
How it's done: Teams manually import their dependencies into their traceability matrix.

4. Verify component licenses: The licenses of each software component need to be verified to ensure compliance with regulatory requirements.

5. Document and maintain the SBOM: Documenting and maintaining your SBOM over time is a long-term stressor for software development teams.

6. Monitor Vulnerabilities: New vulnerabilities are constantly being identified. Per the FDA’s cybersecurity guidance, organizations must have a plan to monitor and address new vulnerabilities in their constantly updating list of used dependencies.

Ketryx generates SBOMs in seconds

Generate an FDA Compliant SBOM in 30 Seconds - YouTube: Generate an FDA Compliant SBOM in 30 Seconds
Ketryx enables organizations to create an FDA-compliant SBOM in seconds and easily manage it over the course of the product life cycle.

Step 1: Open your Ketryx Project dashboard.

Step 2. Select “Create Project” in the left menu and copy your Git Repository URL into the designated box.

Step 3. Watch your updated SBOM generate in seconds, along with much of the FDA required metadata for each item.

Step 4. Assign risk-levels for each dependency and enter in FDA-required information.