(TLP:CLEAR) CISA and Partners Release Joint Guidance: Software Bill of Materials for AI – Minimum Elements

Summary: CISA and the Group of Seven (G7) international partners—Germany, Canada, France, Italy, Japan, the United Kingdom, and the European Union—have released joint guidance, “Software Bill of Materials for AI – Minimum Elements,” to help public and private sector stakeholders improve transparency in their artificial intelligence (AI) systems and supply chains.

Analyst Note: An SBOM is a key part of software supply chain risk management. It aids not only software development but also security teams in vulnerability management, risk assessment, and incident response. It enables the identification and remediation of vulnerabilities, determines the scope and impact of security incidents, and plans recovery efforts more efficiently.

This guidance expands the traditional SBOM concept incorporating AI and emphasizing transparency around AI models, datasets, dependencies, infrastructure, security controls, and third-party components that support AI operations. The guidance notes that AI systems rely on complex supply chains that may include externally sourced models and frameworks, all of which can introduce cybersecurity risk if not properly tracked and understood.

As utilities increasingly evaluate or adopt AI-enabled tools for operational efficiency, cybersecurity, monitoring, or administrative functions, maintaining visibility into AI supply chains and dependencies will become increasingly important.

An SBOM for AI can help organizations better understand how AI systems process and use data, what external services or dependencies are integrated into the environment, and which datasets or models may contain sensitive information.

Original Source: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/SBOM-for-AI_minimum-elements.html

Additional Reading:

• (TLP:CLEAR) CISA, NSA, and Global Partners Release a Shared Vision of Software Bill of Materials (SBOM) Guidance
• What Is a Software Bill of Materials (SBOM)?

Related WaterISAC PIRs: 11, 12