SBOM Compliance Checklist for EU CRA, EO 14028, and Supplier Reviews

Use this checklist to assess whether your SBOM program is ready for real-world scrutiny: procurement reviews, customer security questionnaires, CRA planning, and EO 14028-related supplier expectations. It is not a substitute for legal advice, but it is a practical way to identify gaps in inventory quality, validation, distribution, and vulnerability response.

🇺🇸 US Executive Order 14028 Compliance

Basic Requirements Assessment

NTIA Minimum Elements - Data Fields

• Supplier Name: Can you identify the legal entity for every software component?
• Component Name: Do you have standardized, consistent naming for all components?
• Version Information: Are all component versions accurately captured and tracked?
• Unique Identifiers: Do you use Package URLs (PURLs) or other standard identifiers?
• Dependency Relationships: Can you map parent-child relationships between all components?
• SBOM Author: Is the entity creating SBOM data clearly identified?
• Timestamp: Are all SBOMs timestamped with creation/update dates?

Section Score: ___/7 (____%)

NTIA Minimum Elements - Automation Support

• Machine-Readable Format: Are your SBOMs available in JSON, XML, or other structured formats?
• Automatic Generation: Can you generate SBOMs without manual intervention?
• Tool Integration: Are your SBOMs consumable by common security tools?
• Build Process Integration: Is SBOM generation integrated into your CI/CD pipeline?
• Format Standards: Do you use established standards (CycloneDX, SPDX, SWID)?

Section Score: ___/5 (____%)

NTIA Minimum Elements - Practices and Processes

• Update Frequency: Do you update SBOMs when components change?
• Dependency Depth: Do you capture both direct and transitive dependencies?
• Distribution Methods: Can you securely deliver SBOMs to authorized parties?
• Access Controls: Do you have procedures for protecting sensitive SBOM data?
• Quality Assurance: Do you validate SBOM accuracy before distribution?

Section Score: ___/5 (____%)

Federal Procurement Readiness

Contract Compliance Preparation

• Contract Language Review: Have you reviewed existing federal contracts for SBOM requirements?
• Proposal Capabilities: Can you demonstrate SBOM capabilities in federal proposals?
• Delivery Mechanisms: Do you have secure methods to deliver SBOMs to government customers?
• Response Time Commitments: Can you meet typical government SBOM delivery timelines (24-48 hours)?
• Format Flexibility: Can you deliver SBOMs in government-specified formats?

Critical Software Assessment

• Privileged Access Software: Have you identified software with elevated privileges?
• Network Access Software: Do you track software with direct network access?
• Security Function Software: Are security-related components properly documented?
• Administrative Software: Do you have complete SBOMs for administrative tools?
• Control System Software: Are operational technology components included?

Section Score: ___/10 (____%) US Executive Order 14028 Total Score: ___/27 (____%)

🇪🇺 EU Cyber Resilience Act Readiness

Product Classification and Scope

Digital Product Assessment

• Product Categorization: Have you determined if your products fall under CRA scope?
• CE Marking Readiness: Do you understand CE marking requirements for your products?
• Risk Classification: Have you classified your products by cybersecurity risk level?
• Market Surveillance Preparation: Are you ready for EU market surveillance requirements?
• Conformity Assessment: Do you understand required conformity assessment procedures?

SBOM-Specific CRA Requirements

• Component Transparency: Can you provide complete component inventories?
• Vulnerability Disclosure: Do you have processes for component vulnerability reporting?
• Lifecycle Management: Can you maintain SBOMs throughout product lifecycle?
• Third-Party Integration: Do you collect and integrate supplier SBOMs?
• Authority Access: Can you provide SBOMs to regulators upon request?

Section Score: ___/10 (____%)

Implementation Timeline Readiness

Current Preparation Phase

• Standard Development Monitoring: Are you tracking EN and harmonized standard development?
• Industry Guidance: Do you follow emerging CRA implementation guidance?
• Notified Body Relationships: Have you identified relevant conformity assessment bodies?
• Internal Process Development: Are you developing CRA compliance processes?

2027-2028 Enforcement Readiness

• Full Compliance Capability: Will you be ready for mandatory enforcement by December 2027?
• Documentation Systems: Do you have systems for regulatory documentation?
• Incident Response: Can you handle cybersecurity incidents per CRA requirements?
• Market Withdrawal: Do you have procedures for product recalls if necessary?

Section Score: ___/8 (____%) EU Cyber Resilience Act Total Score: ___/18 (____%)

🏢 Industry Standards Compliance

ISO/IEC Standards Alignment

ISO/IEC 5962:2021 (SPDX) and SPDX 3.0 Compliance

• SPDX Format Support: Can you generate compliant SPDX SBOMs?
• License Information: Do you accurately capture all license data?
• File-Level Details: Can you provide file-level component information when required?
• Copyright Information: Is copyright data properly documented?
• Package Verification: Do you include verification codes and checksums?

ISO/IEC 19770-2:2015 (SWID) Readiness

• SWID Tag Generation: Can you create ISO-compliant SWID tags?
• Software Identification: Do you have unique identifiers for all software?
• Lifecycle Tracking: Can you track software installation and updates?
• Digital Signatures: Do you support cryptographic validation of tags?

Section Score: ___/9 (____%)

Industry-Specific Requirements

Automotive (ISO/SAE 21434:2021)

• Cybersecurity Engineering: Is SBOM integrated into automotive cybersecurity lifecycle?
• Supply Chain Security: Do you manage automotive supplier SBOM requirements?
• Vehicle Integration: Can you create vehicle-level SBOMs from component SBOMs?

Medical Devices (FDA Cybersecurity Guidelines 2023-2024)

• Premarket Documentation: Do you include cybersecurity information in submissions?
• Postmarket Surveillance: Can you track device component vulnerabilities?
• Risk Management: Is SBOM integrated into device risk management processes?

Financial Services

• PCI DSS Alignment: Do you consider SBOM data in payment card compliance?
• Regulatory Reporting: Can you provide component data for financial regulators?
• Third-Party Risk: Do you use SBOMs for vendor risk assessment?

Section Score: ___/9 (____%) Industry Standards Total Score: ___/18 (____%)

🛠️ Technical Implementation Assessment

Tool Capabilities and Integration

SBOM Generation Tools

• Multi-Language Support: Do your tools support all languages in your stack?
• Format Flexibility: Can you generate multiple SBOM formats (CycloneDX, SPDX, SWID)?
• Accuracy Validation: Do you have tools to verify SBOM completeness and accuracy?
• Performance Optimization: Are your tools optimized for large, complex applications?
• Regular Updates: Do you keep SBOM generation tools updated?

CI/CD Pipeline Integration

• Automated Generation: Is SBOM creation fully automated in your build process?
• Quality Gates: Do you have quality checks that prevent builds with incomplete SBOMs?
• Version Control: Are SBOMs versioned and stored with source code?
• Artifact Management: Do you store and manage SBOMs alongside software artifacts?
• Deployment Integration: Are SBOMs deployed with applications for runtime access?

Section Score: ___/10 (____%)

Data Quality and Governance

Data Accuracy and Completeness

• Dependency Discovery: Can you automatically discover all software dependencies?
• Transitive Dependencies: Do you capture complete dependency trees, not just direct dependencies?
• License Detection: Can you accurately identify licenses for all components?
• Version Precision: Do you capture exact version numbers, including patch levels?
• Component Relationships: Can you map complex relationships between components?

Data Management and Governance

• Data Standardization: Do you use consistent data formats and schemas?
• Quality Metrics: Do you measure and track SBOM quality over time?
• Change Management: Do you have processes for handling SBOM updates?
• Data Retention: Do you maintain historical SBOMs for compliance and audit purposes?
• Access Control: Can you control who can view and modify SBOM data?

Section Score: ___/10 (____%) Technical Implementation Total Score: ___/20 (____%)

📋 Organizational Readiness Assessment

Process and Governance

Leadership and Strategy

• Executive Sponsorship: Do you have C-level support for SBOM initiatives?
• Strategic Integration: Are SBOMs part of your overall security and compliance strategy?
• Budget Allocation: Have you allocated sufficient resources for SBOM implementation?
• Success Metrics: Do you have KPIs for measuring SBOM program effectiveness?
• Risk Management: Have you assessed risks of non-compliance with SBOM requirements?

Organizational Structure

• Dedicated Team: Do you have designated personnel responsible for SBOM compliance?
• Cross-Functional Coordination: Do development, security, and legal teams collaborate on SBOM issues?
• Vendor Management: Do you have processes for collecting SBOMs from suppliers?
• Customer Communication: Can you effectively communicate SBOM capabilities to customers?
• Training Programs: Do you provide SBOM training for relevant staff?

Section Score: ___/10 (____%)

Legal and Commercial Readiness

Contract and Legal Framework

• Legal Review Processes: Do you have legal review procedures for SBOM-related contracts?
• Intellectual Property Protection: Can you balance transparency with IP protection?
• Liability Management: Do you understand liability implications of SBOM accuracy?
• Indemnification Terms: Have you addressed SBOM-related indemnification in contracts?
• Confidentiality Agreements: Can you handle confidential component information appropriately?

Commercial and Customer Relations

• Value Proposition: Can you articulate the business value of your SBOM capabilities?
• Customer Support: Do you have support processes for SBOM-related inquiries?
• Competitive Differentiation: Do you use SBOM capabilities for competitive advantage?
• Pricing Strategy: Have you considered pricing implications of SBOM requirements?
• Partnership Strategy: Do you leverage partnerships for comprehensive SBOM coverage?

Section Score: ___/10 (____%) Organizational Readiness Total Score: ___/20 (____%)

🔍 Operational Excellence Assessment

Security and Vulnerability Management

Vulnerability Response Capabilities

• Automated Scanning: Do you automatically scan SBOM components for known vulnerabilities?
• Real-Time Monitoring: Can you detect new vulnerabilities in deployed components?
• Impact Assessment: Can you quickly assess the impact of component vulnerabilities?
• Response Procedures: Do you have documented procedures for vulnerability response?
• Customer Notification: Can you notify customers of component vulnerabilities affecting them?

Supply Chain Security

• Supplier Requirements: Do you require SBOMs from your software suppliers?
• Third-Party Validation: Do you validate the accuracy of supplier-provided SBOMs?
• Supply Chain Monitoring: Can you monitor your supply chain for security issues?
• Vendor Risk Assessment: Do you use SBOMs for supplier security assessments?
• Contingency Planning: Do you have backup plans for supply chain disruptions?

Section Score: ___/10 (____%)

Monitoring and Continuous Improvement

Performance Monitoring

• Quality Metrics: Do you track SBOM completeness, accuracy, and timeliness?
• Performance Analytics: Can you analyze trends in your SBOM program performance?
• Customer Feedback: Do you collect and act on customer feedback about your SBOMs?
• Benchmark Comparison: Do you compare your capabilities to industry benchmarks?
• Cost Tracking: Do you monitor the costs and ROI of your SBOM program?

Continuous Improvement

• Regular Reviews: Do you conduct regular assessments of your SBOM program?
• Process Optimization: Do you continuously improve your SBOM processes?
• Technology Updates: Do you stay current with SBOM tools and technologies?
• Standard Evolution: Do you track changes in SBOM standards and requirements?
• Lessons Learned: Do you document and share lessons learned from SBOM implementation?

Section Score: ___/10 (____%) Operational Excellence Total Score: ___/20 (____%)

📊 Overall Compliance Assessment

Scoring Summary

Complete this section after finishing all assessments:

Category	Your Score	Possible	Percentage
US Executive Order 14028	___/27	27	___%
EU Cyber Resilience Act	___/18	18	___%
Industry Standards	___/18	18	___%
Technical Implementation	___/20	20	___%
Organizational Readiness	___/20	20	___%
Operational Excellence	___/20	20	___%
TOTAL SCORE	___/123	123	___%

Maturity Level Assessment

Based on your overall score:

🏆 Excellent (90-100%) - Compliance Leader

You're well-positioned for current and future SBOM requirements. Focus on:

• Maintaining competitive advantage through superior capabilities
• Contributing to industry standards and best practices
• Leveraging SBOM data for business intelligence and optimization

✅ Good (70-89%) - Compliance Ready

You're on track for compliance with minor gaps. Prioritize:

• Addressing specific gaps identified in lower-scoring sections
• Improving automation and process efficiency
• Enhancing quality assurance and validation procedures

⚠️ Fair (50-69%) - Action Required

Significant work needed to achieve compliance. Focus on:

• Developing comprehensive implementation plan
• Securing executive sponsorship and resources
• Starting with pilot projects to build capabilities

🚨 Critical (Below 50%) - Immediate Attention

Major compliance gaps require urgent action. Start with:

• Executive-level assessment of regulatory risks
• Emergency resource allocation for compliance program
• Engaging external expertise to accelerate implementation

🎯 Prioritized Action Plan Generator

Based on your assessment results, here's your recommended action plan:

Immediate Actions (Next 30 Days)

If you scored below 70% overall:

• 🚨 Conduct executive briefing on regulatory requirements and business risks
• 💰 Allocate emergency resources for SBOM compliance program
• 🎯 Identify critical software products requiring immediate attention
• 🔧 Begin tool evaluation for SBOM generation capabilities

If you scored 70%+ overall:

• 📋 Address highest-impact gaps identified in assessment
• ⚡ Optimize existing processes for better efficiency and accuracy
• 📢 Develop customer communication about your SBOM capabilities
• 🏆 Create competitive advantage through superior transparency

Medium-Term Goals (3-6 Months)

For all organizations:

• ⚙️ Implement comprehensive SBOM generation across all relevant products
• ✅ Establish quality assurance processes for SBOM accuracy and completeness
• 🔒 Create customer delivery mechanisms for secure SBOM distribution
• 🛡️ Develop vulnerability response procedures integrated with SBOM data

Long-Term Strategy (6-18 Months)

Strategic initiatives:

• 🎯 Achieve full regulatory compliance for all applicable requirements
• 🚀 Optimize operational efficiency through automation and integration
• 💎 Develop competitive differentiation through superior SBOM capabilities
• 🔮 Prepare for emerging requirements and market opportunities

📚 Resources for Improvement

Gap-Specific Resources

For Technical Implementation Gaps:

• CycloneDX Tool Center
• SPDX Tools and Libraries
• NTIA SBOM Tooling Taxonomy

For Compliance Framework Understanding: For Organizational Readiness:

• NIST Cybersecurity Framework
• CISA SBOM Sharing Guidelines
• Linux Foundation SBOM Training

Professional Services and Training

Consider engaging external help if:

• Your overall score is below 50%
• You have regulatory deadlines approaching
• You lack internal expertise for implementation
• You need accelerated time-to-compliance

Types of assistance available:

• SBOM compliance consulting and implementation services
• Tool selection and integration professional services
• Training and certification programs for internal teams
• Legal and regulatory guidance for contract and compliance issues

🔄 Regular Assessment Schedule

Recommended Assessment Frequency

Quarterly Reviews:

• Update assessment based on implementation progress
• Track improvements in compliance scores
• Adjust priorities based on regulatory developments

Annual Comprehensive Reviews:

• Complete full assessment with all stakeholders
• Benchmark against industry best practices
• Update strategic plans and resource allocations
• Review and update compliance policies and procedures

Event-Driven Reviews:

• New regulatory requirements or guidance
• Significant changes to your software portfolio
• Major security incidents or vulnerability disclosures
• Customer requests or contract requirements changes

Conclusion

This comprehensive checklist provides a structured approach to assessing your SBOM compliance readiness across all major requirements. Regular use of this assessment will help you:

• Track progress toward full compliance
• Identify priority areas for investment and improvement
• Demonstrate readiness to customers and regulators
• Maintain competitive advantage through superior capabilities

Remember: SBOM compliance is a journey, not a destination. Requirements continue to evolve, and maintaining compliance requires ongoing attention and investment. Use this checklist as your roadmap to building and maintaining world-class SBOM capabilities. Start your assessment today and begin your journey toward complete SBOM compliance readiness.