--- title: "U.S. Army Announces New SBOM Requirements" description: "The U.S. Army has announced new SBOM requirements for contractors and subcontractors to improve software supply chain security. Learn about the implementation timeline, scope, and how to prepare." canonical_url: "https://fossa.com/blog/us-army-announces-new-sbom-requirements/" markdown_url: "https://fossa.com/blog/us-army-announces-new-sbom-requirements.md" content_type: "blog" language: "en" date_published: "2024-09-13" date_modified: "2024-09-13" author: ["Andy Drukarev", "Karinna Simmons"] organization: "FOSSA" --- # U.S. Army Announces New SBOM Requirements > The U.S. Army has announced new SBOM requirements for contractors and subcontractors to improve software supply chain security. Learn about the implementation timeline, scope, and how to prepare. To contend with growing [software supply chain security threats](https://fossa.com/learn/software-supply-chain-security.md), an increasing number of governments and regulatory bodies have started to implement SBOM (software bill of materials) regulations. Among the latest is the U.S. Army. An Aug. 16 [memo](https://federalnewsnetwork.com/wp-content/uploads/2024/09/081624_Army_SBOM_Memo.pdf) from Assistant Secretary of the Army (Acquisition, Logistics, and Technology) Douglas R. Bush directed the branch to start including contract language requiring [SBOMs](https://fossa.com/learn/sboms.md) for “covered computer software.” The regulations will likely take effect in early 2025 and will cover most contractors and subcontractors that sell software to the Army. The goal of the SBOM requirement is “to enhance software supply chain risk management practices and effectively mitigate software supply chain risks.” In this blog, we’ll cover the requirement’s details, scope, impacted parties, and implementation timeline. We’ll also discuss steps Army software contractors and subcontractors can take now to prepare. ![SBOM Starter Kit](https://fossa.com/large-1.png) ## Requirement Scope The Army’s new [SBOM requirements](https://fossa.com/learn/sbom-compliance-requirements.md) will apply to all “covered computer software.” The branch’s memo defines “covered computer software” as: > “... any computer software developed exclusively with Government funds to include Government-off-the-Shelf software, any computer software developed by a Contractor using exclusively Contractor funds or Independent Research and Development funds, any commercial computer software (as defined by FAR 2.101), and any noncommercial computer software developed and delivered to the Government by a Contractor.” The memo also notes that “commercial computer software” includes both COTS (commercial-off-the-shelf) and open source. There is one notable exemption from the requirement: Cloud services are not currently covered by the regulation. Critically, the requirement applies to both Army contractors and subcontractors. The memo specifies that contract language and SBOM obligations must be passed down to all software development or delivery subcontractors. In other words, if you provide software to the Army — or if you provide software to a vendor that provides software to the Army — you’ll need to be prepared to produce and deliver an SBOM. ## Implementation Timeline and Requirements The memo outlines a series of next steps as the Army works toward fully adopting the new regulations. Here are some of the key milestones on the implementation timeline. **Within 90 Days of the Memo’s Release: Sample Guidance** By Nov. 14, 2024, the Deputy Assistant Secretary of the Army will provide several pieces of guidance to inform the specifics of implementation. This will include: - Sample contract language for requiring an SBOM - Sample data descriptions - A guide for SBOM management and implementation **Within 90 Days of the Sample Guidance Release: Incorporating Contract Language** Within 90 days of the release of the aforementioned guidance and sample materials, the Army’s Program Executive Offices (PEO) and Program Managers (PM) will be tasked with: - Incorporating SBOM contract language for new contracts - Ensuring said contract language gets passed down to subcontractors - Codifying processes for SBOM collection, storage, management, and monitoring - Codifying processes for managing vulnerabilities that surface via SBOM monitoring **90 Days After the Sample Guidance Release: Collect, Store, Manage, and Monitor SBOMs** The regulations will fully take effect 90 days after the release of the sample guidance discussed earlier in this section. In other words, beginning in February 2025, the Army will start collecting and analyzing SBOMs from software contractors and subcontractors. The branch will also begin SBOM management and continuous monitoring activities to maximize software supply chain security benefits. ## Preparing for Compliance Although certain details of the Army’s SBOM regulations are still being developed, contractors and subcontractors can take steps now to get prepared. 1. **SBOM generation** First and foremost, since the Army is clear that its goal for requiring SBOMs is to facilitate ongoing vulnerability management, contractors and subcontractors should be prepared to generate an SBOM in a machine-readable format like SPDX or CycloneDX. It’s also likely safe to assume that the Army will require SBOMs to include at least the [NTIA-required minimum elements](https://fossa.com/blog/minimum-required-elements-software-bill-of-materials.md), so it’s wise to choose an [SBOM tool](https://fossa.com/blog/sbom-tool-buyer-guide.md) that supports those data fields. 2. **SBOM distribution** It’s also critical for contractors to start having the SBOM conversation with their subcontractors and to develop a plan for [SBOM sharing](https://fossa.com/blog/4-considerations-effective-sbom-sharing.md). (A tool like FOSSA’s private SBOM portal — which allows for time-based access control — is often a good solution.) 3. **SBOM ingestion** Along with a strategy for securely sharing/collecting SBOMs, it’s also important to be able to successfully ingest the SBOMs you receive. This will allow you to combine what you collect from subcontractors with your own SBOM to form an application-level SBOM that you distribute. 4. **Vulnerability identification and management** In contrast to some other SBOM regulations (e.g. [the FDA’s](https://fossa.com/blog/complying-fdas-sbom-requirements.md), the Army memo doesn’t specifically require contractors to provide a list of vulnerabilities (and mitigations) associated with the SBOM. However, this could conceivably change in the future, so it’s not a bad idea to get a process and/or tool in place that provides this capability. (Also, it’s not outside of the realm of possibility that the Army’s contract language could end up requiring contractors to provide some sort of vulnerability information; we should get confirmation one way or the other once the sample guidance is released in the coming months.) ## How FOSSA Helps Manage SBOM Compliance Regulations FOSSA is currently helping organizations in a variety of regulated industries manage compliance with SBOM regulations. Our SBOM management solution makes it easy to generate SBOMs, ingest SBOMs from software suppliers, analyze SBOMs to understand security risks, and securely distribute SBOMs. The FOSSA platform also captures vulnerability fix decisions via automated VEX annotations, which is a useful feature for fulfilling customer requests and potentially regulatory requirements. [Please reach out to our team](https://fossa.com/request-sbom-demo) for more information on how we can help your organization navigate SBOM requirements. ## Related resources - [CISA Releases the 2026 SBOM Minimum Elements](https://fossa.com/blog/cisa-releases-2026-minimum-sbom-elements.md): CISA, the U.S. government's Cybersecurity and Infrastructure Security Agency, released an update to its Minimum Elements for a Software Bill of Materials publication. - [Allan Friedman: Practical Guidance for Managing VEX Workflows](https://fossa.com/blog/allan-friedman-practical-guidance-managing-vex-workflows.md): Leading software supply chain security expert Allan Friedman shares concrete strategies for software producers and consumers to get value from VEX. - [A Roadmap for Automating the SBOM Management Lifecycle](https://fossa.com/blog/roadmap-automating-sbom-management-lifecycle.md): Get practical guidance for navigating each step of the SBOM management lifecycle. - [Allan Friedman on SBOM Regulations](https://fossa.com/blog/allan-friedman-sbom-regulations.md): Leading SBOM and software supply chain expert Allan Friedman analyzes several major SBOM regulations, including PCI DSS and the CRA. - [Allan Friedman on 4 Stages of SBOM Management](https://fossa.com/blog/allan-friedman-4-stages-sbom-management.md): Leading SBOM and software supply chain expert Allan Friedman shares recommendations for SBOM programs at various stages of maturity. ## Source Canonical page: https://fossa.com/blog/us-army-announces-new-sbom-requirements/