Cryptographic device identity, secure boot and signed firmware built into field controllers and smart final-control elements themselves, not bolted on at the network layer.
SBOM & software supply-chain transparency for ICS
Industrial IT / OT / Critical Control Information Infrastructure
Over-Promise
Near-term · 2–5 yrs
Evidence E3 · First production use
Machine-readable inventories of the software components inside control-system products, used to find which assets are affected when a vulnerability is disclosed. The EU Cyber Resilience Act turns SBOMs from good practice into a legal requirement for products sold in the EU from December 2027.
What an SBOM is, and why OT needs one
A software bill of materials lists the components in a piece of software: each library, its supplier and version, and its relationships to other components, in a machine-readable format. The two dominant formats are SPDX, published as ISO/IEC 5962, and CycloneDX, published as ECMA-424. An SBOM does not say whether a product is vulnerable. It says what is inside, so the contents can be matched against vulnerability databases.
For control systems the value is concrete. When a vulnerability is disclosed in a widely used component, such as an open-source network library or an embedded operating system, an asset owner needs to know which controllers, gateways, HMIs and engineering tools contain it. Today that usually means waiting for each supplier's advisory, which can take weeks or months. With SBOMs and an accurate asset inventory, the owner can answer the first question in hours.
Regulation is setting the timetable
The EU Cyber Resilience Act (CRA) entered into force on 10 December 2024 1. Its reporting obligations have applied since 11 September 2026: manufacturers must send an early warning of an actively exploited vulnerability to ENISA and the designated national CSIRT within 24 hours of becoming aware of it, a fuller notification within 72 hours, and a final report within 14 days of a fix being available, or one month for a severe incident 1.
The CRA's remaining requirements apply from 11 December 2027, including the obligation to draw up an SBOM in a commonly used, machine-readable format covering at least the product's top-level dependencies, as part of the technical documentation 14. The CRA requires the SBOM to be available to market-surveillance authorities on request; it does not require manufacturers to publish it to customers, although many asset owners will ask for it contractually.
In the United States, CISA released an update of the minimum elements for an SBOM for public comment in August 2025. The draft adds component hash, licence, the name of the tool that generated the SBOM and its generation context to the 2021 baseline 23. For industrial products, IEC 62443-4-1 on the secure development lifecycle already expects suppliers to manage third-party components; SBOMs are the evidence that they do.
| Date | What applies |
|---|---|
| 10 Dec 2024 | The CRA enters into force |
| 11 Jun 2026 | Provisions on conformity-assessment bodies apply |
| 11 Sep 2026 | Reporting of actively exploited vulnerabilities and severe incidents |
| 11 Dec 2027 | Full application, including the SBOM requirement |
Why OT is harder than IT
- Legacy products. Much of the installed base was built before SBOMs existed, from components whose suppliers may no longer exist. Generating SBOMs for current releases is far easier than for products installed fifteen years ago.
- Firmware. Embedded devices contain components compiled into firmware images, which are harder to analyse than application packages. Binary-analysis tools help but are imprecise.
- Noise. An SBOM matched against vulnerability databases produces long lists of findings, many not exploitable in the product. VEX statements, in which the supplier declares whether a product is affected, are needed to make SBOMs usable rather than alarming.
- Consumption. Most asset owners do not yet have tooling that links SBOMs to their live asset inventory. Without that, an SBOM is a document in a procurement file.
What owners should do now
Ask for SBOMs and VEX in new purchase specifications, in an agreed format, together with commitments on how quickly they will be updated after each release. Build or buy the capability to ingest them, usually through the asset-inventory function of an OT monitoring platform or a dedicated SBOM-management tool. Start with the systems where an unpatched vulnerability would matter most: remote-access gateways, engineering workstations and network-facing controllers.
For manufacturers selling into the EU, the reporting obligations are already live. The practical test is whether the organisation could identify, within 24 hours, which of its shipped products contain a newly exploited component. Without SBOMs, that test is hard to pass.
Evidence timeline
- Dec 2024EU Cyber Resilience Act enters into force. 1
- Aug 2025CISA releases draft 2025 minimum elements for an SBOM for public comment. 3
- Sep 2026CRA vulnerability and incident reporting obligations apply. 1
- Dec 2027CRA applies in full, including the SBOM requirement. 1
Why it sits at the Over-Promise stage
Regulation is driving a surge of attention, tooling announcements and procurement language, and the ability to produce SBOMs is running ahead of the ability to use them in OT. That is the Over-Promise stage.
We expect a dip as owners discover how much work consumption takes, particularly for legacy and embedded products, before SBOM exchange settles into routine procurement and vulnerability management. The fixed CRA deadline keeps the horizon near-term.
Adoption signals to watch
- Control-system suppliers publishing SBOM and VEX for current product releases as standard.
- OT monitoring and asset-inventory platforms ingesting SBOMs automatically.
- Harmonised European standards supporting CRA conformity for industrial products.
Questions to ask before committing
- Will the supplier provide SBOMs and VEX for this product, in which format, and how soon after each release?
- What depth of dependencies will the SBOM cover, and does it include firmware components?
- Which tool will we use to match SBOMs against our asset inventory and vulnerability feeds?
- If we manufacture products for the EU, can we identify affected products within 24 hours of an exploited vulnerability becoming known?
Terms used on this page
- SPDX
- A standard SBOM format, published as ISO/IEC 5962.
- CycloneDX
- A widely used SBOM format, published as ECMA-424.
- VEX
- Vulnerability Exploitability eXchange, a statement of whether a product is affected by a given vulnerability.
Sources
- EU Cyber Resilience Act reporting: what CISOs need to know
- 2025 Minimum Elements for a Software Bill of Materials (draft)
- CISA releases draft changes to SBOM minimum requirements for comment
- EU Cyber Resilience Act compliance guide
Related technologies
See this entry on the full maturity map · All IT/OT & CCII entries · How placements are made. Stage and time-horizon placements are editorial judgements based on the public sources listed above, as of October 2026. They are not engineering, safety or investment advice; see the Terms of Use.