The Energy Sector Software Bill Of Materials (SBOM) Proof of Concept (POC) will convene a group of diverse energy-sector stakeholders in an open, transparent, consensus-based process to explore the application of SBOMs within energy sector environments and catalyze progress in SBOM adoption to increase transparency of software components within the sector.

In an open forum, this group will develop tools and technologies for SBOM adoption into the energy sector, including leveraging the work of the following NTIA SBOM Working Groups:

  • Framing – SBOM specification and structures
  • Formats and Tooling – Automation of SBOMS including tools, processes, and playbooks
  • Awareness and Adoption – Outreach strategies and business cases
  • Automotive Proof of Concept – Explored adoption of SBOM within the Automotive Sector
  • Healthcare Proof of Concept – Explored adoption of SBOM within the Medical Device Community

energy sector proof of concept software bill materials

Meeting Materials

SBOM Cooking Class
October 6, 2021

SBOM Cooking Class
September 22, 2021

Use Cases for SBOM
September 8, 2021

Use Cases for SBOM
August 25, 2021

Use Cases for SBOM
July 14, 2021

SBOM Generation Supplier
June 30, 2021

Brainstorming
June 16, 2021

MURAL Synthesis Work
June 2, 2021

SBOM-POC Charter
May 19, 2021

Proof of Concept Kickoff Meeting
April 26, 2021

Additional Resources

SBOM Energy POC Charter

Roles and Benefits for SBOM Across the Supply Chain

SBOM Energy POC Meetings

Please join the Energy Sector SBOM Proof-of-Concept bi-weekly meetings.

Meetings are held alternating Wednesdays at 12 PM – 1PM EST
Participants will continue to receive email invitations as we progress.

TO BE ADDED TO MEETING INVITATIONS, PLEASE EMAIL:

SBOM Cooking Class
October 6, 2021

SBOM Cooking Class
September 22, 2021

Use Cases for SBOM
September 8, 2021

Use Cases for SBOM
August 25, 2021

SBOM Generation Supplier
June 30, 2021

Brainstorming
June 16, 2021

MURAL Synthesis Work
June 2, 2021

Agenda: To identify specific topics, use cases, and technology gaps the POC would like to focus on in the remainder of the calendar year. We will be using a tool called MURAL to allow the group to work together and we will send an advance copy of the “board” in case there are those for whom this technology will not work.

SBOM-POC Charter
May 19, 2021

Agenda:

  • Review draft charter for Energy Sector SBOM POC
  • Facilitated feedback and discussion around charter and mission
  • Logistics and organization moving forward

Proof of Concept Kickoff Meeting
April 26, 2021

Attendees may be interested in this review of SBOM use cases, and the benefits across the ecosystem. We encourage you to review it before Monday’s meeting: NTIA SBOM Use Cases Roles and Benefits, 2019 [PDF]Energy POC planning April web pdf image

SBOM Energy POC Charter

The Project Charter captures high level planning information (scope, deliverables, assumptions, etc.) about the SBOM Proof of Concept effort.

 

Roles and Benefits for SBOM Across the Supply Chain

NTIA Multi-stakeholder Process on Software Component Transparency Use Cases and State of Practice Working Group

November 2019

Introduction:

Software is everywhere. Like steel and concrete, software increasingly plays a foundational role in a modern, connected society and like those other building materials, how and with what ingredients the building materials are created often matters. Software permeates banking, healthcare, utilities, emergency services, national defense, government systems, and the like. The software includes operating systems, firmware, and embedded systems within our gadgets, devices, IoT, and other machines. And just like these physical goods, the software has a supply chain that may need to be understood and managed by an organization dependent on that software.

nhs Methodology

About Software Bill of Materials

This is an introduction to the practice of Software Bill of Materials (SBOM), supporting literature, and the pivotal role SBOMs play in providing much-needed transparency: enabling stakeholders to answer questions like “Am I affected?” and “Where am I affected?” when faced with a supply chain concern.

SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships. These inventories should be comprehensive – or should explicitly state where they could not be. SBOMs may include open source or proprietary software and can be widely available or access-restricted.

SBOMs should also include baseline attributes with the ability to uniquely identify individual components in a standard data format. The most efficient generation of SBOMs is as a byproduct of a modern development process. For older software, less-automated methods exist.

About Participating Sponsors

DOE CESER

The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) addresses the emerging threats of tomorrow while protecting the reliable flow of energy to Americans today by improving energy infrastructure security and supporting the Department of Energy’s national security mission. CESER’s focus is preparedness and response activities to natural and man-made threats, while ensuring a stronger, more prosperous, and secure future for the nation.

Idaho National Laboratory

Idaho National Laboratory is a world leader in providing industrial control system (ICS) cybersecurity workforce training and development. The laboratory’s distinctive history in protecting critical infrastructure systems puts the lab at the forefront of thought leadership and applied innovation in critical infrastructure cybersecurity education. INL uses a comprehensive approach to developing ICS cybersecurity training programs that can be tailored to meet the energy sector’s needs identified by the DOE, utilities, and other organizations.

National Telecommunications and Information Administration (NTIA)

NTIA is the Executive Branch agency that is principally responsible for advising the President on telecommunications and information policy issues. NTIA’s programs and policymaking focus largely on expanding broadband Internet access and adoption in America, expanding the use of spectrum by all users, and ensuring that the Internet remains an engine for continued innovation and economic growth.