EU Agency ENISA Releases Software Bill of Materials (SBOM) Technical Guide: Proposes Six-Stage Lifecycle and Anti-Tampering Strategies
ENISA releases a technical guide for Software Bills of Materials (SBOM), outlining a six-stage lifecycle management process and emphasizing anti-tampering measures to help companies comply with the EU Cyber Resilience Act.
The European Union Agency for Cybersecurity (ENISA) officially released the "Technical Advisory for Software Bill of Materials" on October 22, 2026. The guide aims to enhance software supply chain transparency and assist companies in meeting obligations under the EU Cyber Resilience Act (CRA). It proposes a six-stage lifecycle management process covering generation, validation, signing, storage, usage, and maintenance, recommending integration into Continuous Integration/Continuous Delivery (CI/CD) pipelines.
ENISA specifically highlights security risks associated with SBOMs, using the STRIDE threat model to analyze six categories of threats: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Attackers could impersonate legitimate vendors to distribute tampered SBOMs, causing enterprises to mistakenly trust malicious or compromised components. Without proper access controls, version and dependency information within SBOMs could also leak, providing intelligence to attackers. The guide recommends digital signatures, identity verification, access control, and audit logs to strengthen SBOM integrity.
Addressing practical implementation challenges, ENISA cites an industry survey from June showing that while 41% of respondents want fully automated SBOM generation during each build, only 26% expect full automation during the product support period. This underscores the need for continuous update, validation, and version tracking mechanisms to prevent discrepancies between the list and actual software versions. Additionally, the guide lists available open-source tools categorized by CycloneDX and SPDX formats, such as Syft, cdxgen, Cosign, and Trivy, offering references for micro and small-to-medium enterprises.