Cybersecurity and Infrastructure Security Agency
Software developers and vendors often create products by assembling existing open source and commercial software components. An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. Developers often use available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. If there has been any change in exemption qualification status, Covered Entities should amend or terminate their exemption as soon as possible and have 180 days from the end of the fiscal year in which they cease to be exempt to comply with all applicable requirements of Part 500. To amend or terminate previous filings, see the next section titled Cybersecurity-related Filings, Amending or Terminating a Filed Exemption. Section 19 of the Cybersecurity Regulation sets forth certain exemptions for which Covered Ent...