CISA Issues Fresh SBOM Guidance. Did They Get It Right?

CISA has released updated guidance on Software Bill of Materials (SBOMs), adding 10 new elements and refining existing ones to improve comprehensiveness. However, critics, like OWASP founder Jeff Williams, argue that the changes are largely procedural and don't address the fundamental issue of ensuring SBOMs accurately reflect deployed software and support meaningful security decisions. The guidance also includes separate advice on open-source software security, including a ‘default open source’ approach for government agencies and increased scrutiny of AI training data.