Software bill of materials

The software bill of materials is the first instrument allowing the state of an information estate to be measured objectively. An underwriting questionnaire has until now asked whether the business holds a patching policy, a question whose answer is always yes and whose discriminating value is therefore nil. The bill of materials allows one to ask what the estate actually contains, a question whose answer is verifiable by exhibit. Its reach exceeds individual selection: once generalized, it finally makes accumulation measurable, an insurer being able in principle to establish how many of its insureds depend on the same library and to estimate the burden of a critical vulnerability before it occurs. That is exactly the information missing during the major episodes of widely distributed vulnerability, where the market discovered its exposure after the fact. Not to be confused with an asset inventory, which lists machines: the bill of materials lists the components of each piece of software, libraries and versions included. Where the word appears: in US Executive Order 14028 of 12 May 2021, which required it of federal suppliers, in Annex I of the EU Cyber Resilience Act, and in questionnaires under the acronym SBOM.