Skip Navigation
Resources Blog Mastering SBOMs: Best practices

Mastering SBOMs: Best practices

In our recent webinar, Mastering SBOMs: Best Practices, speakers, including Ilkka Turunen, Field CTO, Sonatype, Roger Smith, Global Testing and Digital Assurance Lead, DXC Technology, and Marc Luescher, Solution Architect, AWS, shed light on the importance of software bills of materials (SBOMs) in software development.

What impact does the federal government have on SBOM management?

Roger Smith underscored that SBOMs are not just critical but foundational elements in software development, serving as table stakes for securing applications and software supply chains.


Smith advocated for regular adoption of SBOM practices to:

  • enhance situational awareness;
  • eliminate security by obscurity; and 
  • comply with the stringent requirements.

These practices are especially important in highly regulated industries such as finance, banking, government, and defense.

The webinar covered real-world examples of security incidents stemming from poor supply chain management, which underlines the need for a robust SBOM strategy. The evolving regulatory landscape adds pressure on organizations to comply with SBOM guidelines and possible requirements.

SBOMs have become invaluable tools in identifying security vulnerabilities and ensuring compliance with licensing requirements. By offering visibility into third-party, especially open source, components in the software supply chain, SBOMs act as a safeguard against potential security breaches.

What is the recommended approach to SBOM management?

While what constitutes best practices depends upon your organization's requirements and operations, our speakers in this webinar put forth ideas such as:

  • Update your SBOMs regularly;
  • Integrate SBOM generation into your software development life cycle (SDLC) or continuous integration/continuous delivery (CI/CD) pipelines;
  • Automate SBOM generation and updates;
  • Prioritize vulnerability tracking and management;
  • Strive for completeness and accuracy at every level with your SBOMs;
  • Treat SBOMs as sensitive information; and
  • Regularly review SBOMs for licensing and compliance issues.
  • Consider using Sonatype SBOM Manager to effectively leverage SBOMs.

SBOMs are critical in enhancing software supply chain security. Access the webinar recording to watch the top 7 best practices for SBOM management.

We encourage organizations, especially in regulated industries, to catch part 2 of this series, SBOMs in Action: Demonstrations to adopt SBOMs as a standard practice to fortify their software infrastructure.


Picture of Keiana King

Written by Keiana King

Keiana is a Digital Marketing Copywriter at Sonatype with a passion for brand communication. Based in Brooklyn, NY and originally from Northern Virginia, Keiana studied Product and Brand Management at Virginia Commonwealth University. When she's not gawking over her favorite brands she's out hunting taco spots.