🚨 CERT-In Releases Technical Guidelines on SBOM, QBOM, CBOM, AIBOM & HBOM
The Indian Computer Emergency Response Team (CERT-In) has released Version 2.0 of its technical guidelines on the Software Bill of Materials (SBOM), now significantly expanded to cover five critical domains:
1. SBOM – A detailed list of all software components, including third-party elements, used in a software product. It helps identify and mitigate vulnerabilities within the codebase.
2. QBOM – Focuses on components related to quantum computing and quantum-safe cryptography. It inventories quantum algorithms and security frameworks, aiding organizations in preparing for and adopting post-quantum cryptographic (PQC) solutions.
3. CBOM – An inventory of all cryptographic assets such as algorithms, encryption keys, and security protocols used within an organization. It helps in ensuring transparency and up-to-date security measures.
4. AIBOM – A comprehensive list of all components used in the development, training, and deployment of AI models, including hardware (e.g., GPUs), software frameworks, and datasets. AIBOMs are becoming essential for ensuring security, transparency, compliance, and risk management in AI systems. All organizations involved in AI-driven development and services are advised to include AIBOM requirements in all AI-related procurements and solutions.
5. HBOM – A list of all physical components, such as servers, networking gear, and storage devices that make up a hardware system. It helps in tracking, auditing, and managing hardware-related risks.
These guidelines are especially relevant for government bodies, public sector units, essential services organizations, and entities involved in software exports and software services.
It is aimed at:
1. Software Consumers – Organizations that purchase and use software to support operations.
2. Software Developers – Entities that build and maintain custom software solutions.
3. System Integrators / Software Resellers – Organizations that distribute software products and provide related services.
By adopting these guidelines, organizations can bolster security, accelerate incident response, identify and patch vulnerabilities more efficiently, mitigate supply chain risks, ensure regulatory compliance, and enhance overall operational resilience.
This is an essential step in building more secure, transparent, and future-ready digital ecosystems.
👉 Link to the full guidelines is in the comments.
#ai #india #aigovernance #cybersecurity
[This post is for educational purposes only and does not constitute legal advice. The views expressed herein are personal and not reflective of any institution or company. Likes or interactions with this content do not imply endorsements.]
17
1 Comment