The Energy Sector Software Bill Of Materials (SBOM) Proof of Concept (POC) will convene a group of diverse energy-sector stakeholders in an open, transparent, consensus-based process to explore the application of SBOMs within energy sector environments and catalyze progress in SBOM adoption to increase transparency of software components within the sector.

In an open forum, this group will develop tools and technologies for SBOM adoption into the energy sector, including leveraging the work of the following NTIA SBOM Working Groups:

  • Framing – SBOM specification and structures
  • Formats and Tooling – Automation of SBOMS including tools, processes, and playbooks
  • Awareness and Adoption – Outreach strategies and business cases
  • Automotive Proof of Concept – Explored adoption of SBOM within the Automotive Sector
  • Healthcare Proof of Concept – Explored adoption of SBOM within the Medical Device Community

energy sector proof of concept software bill materials

Meeting Info and Presentations

Minimum Elements of SBOM - July 14, 2021

SBOM Generation Supplier - June 30, 2021

Brainstorming - June 16, 2021

MURAL Synthesis Work - June 2, 2021

SBOM-POC Charter - May 19, 2021

Proof of Concept Kickoff Meeting - April 26, 2021

Additional Resources

SBOM Energy POC Charter

Roles and Benefits for SBOM Across the Supply Chain

SBOM Energy POC Meetings

Please join the Energy Sector SBOM Proof-of-Concept bi-weekly meetings.

Starting May 19, 2021, meetings are:
Every other Wednesday at 12 PM – 1PM EST
Participants will continue to receive email invitations as we progress.

Meetings for Calendar Year 2021:
June 2, June 16, June 30
July 14, July 28
August 4, August 18
September 1, September 15, September 29
October 13, October 27
November 10

SBOM Generation Supplier - June 30, 2021

Brainstorming - June 16, 2021

MURAL Synthesis Work - June 2, 2021

Agenda: To identify specific topics, use cases, and technology gaps the POC would like to focus on in the remainder of the calendar year. We will be using a tool called MURAL to allow the group to work together and we will send an advance copy of the “board” in case there are those for whom this technology will not work.

SBOM-POC Charter - May 19, 2021

Agenda:

  • Review draft charter for Energy Sector SBOM POC
  • Facilitated feedback and discussion around charter and mission
  • Logistics and organization moving forward

Proof of Concept Kickoff Meeting - April 26, 2021

Attendees may be interested in this review of SBOM use cases, and the benefits across the ecosystem. We encourage you to review it before Monday’s meeting: NTIA SBOM Use Cases Roles and Benefits, 2019 [PDF]Energy POC planning April web pdf image

SBOM Energy POC Charter

The Project Charter captures high level planning information (scope, deliverables, assumptions, etc.) about the SBOM Proof of Concept effort.

 

Roles and Benefits for SBOM Across the Supply Chain

NTIA Multi-stakeholder Process on Software Component Transparency Use Cases and State of Practice Working Group

November 2019

Introduction:

Software is everywhere. Like steel and concrete, software increasingly plays a foundational role in a modern, connected society and like those other building materials, how and with what ingredients the building materials are created often matters. Software permeates banking, healthcare, utilities, emergency services, national defense, government systems, and the like. The software includes operating systems, firmware, and embedded systems within our gadgets, devices, IoT, and other machines. And just like these physical goods, the software has a supply chain that may need to be understood and managed by an organization dependent on that software.

nhs Methodology

About Software Bill of Materials

This is an introduction to the practice of Software Bill of Materials (SBOM), supporting literature, and the pivotal role SBOMs play in providing much-needed transparency: enabling stakeholders to answer questions like “Am I affected?” and “Where am I affected?” when faced with a supply chain concern.

SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships. These inventories should be comprehensive – or should explicitly state where they could not be. SBOMs may include open source or proprietary software and can be widely available or access-restricted.

SBOMs should also include baseline attributes with the ability to uniquely identify individual components in a standard data format. The most efficient generation of SBOMs is as a byproduct of a modern development process. For older software, less-automated methods exist.

About Participating Sponsors

DOE CESER

The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) addresses the emerging threats of tomorrow while protecting the reliable flow of energy to Americans today by improving energy infrastructure security and supporting the Department of Energy’s national security mission. CESER’s focus is preparedness and response activities to natural and man-made threats, while ensuring a stronger, more prosperous, and secure future for the nation.

Idaho National Laboratory

Idaho National Laboratory is a world leader in providing industrial control system (ICS) cybersecurity workforce training and development. The laboratory’s distinctive history in protecting critical infrastructure systems puts the lab at the forefront of thought leadership and applied innovation in critical infrastructure cybersecurity education. INL uses a comprehensive approach to developing ICS cybersecurity training programs that can be tailored to meet the energy sector’s needs identified by the DOE, utilities, and other organizations.

National Telecommunications and Information Administration (NTIA)

NTIA is the Executive Branch agency that is principally responsible for advising the President on telecommunications and information policy issues. NTIA’s programs and policymaking focus largely on expanding broadband Internet access and adoption in America, expanding the use of spectrum by all users, and ensuring that the Internet remains an engine for continued innovation and economic growth.