NSA Recommendations for SBOM Management

The office of the National Manager for National Security Systems (NSS), working in collaboration with other NSA organizations, researched and tested tools that SBOMs as part of a Cybersecurity Supply Chain Risk Management (C-SCRM) strategy. This guidance includes important recommendations for SBOM management tool functionality derived from the research and evaluation of various SBOM management tools.