Introduction
In an increasingly interconnected digital ecosystem, the complexity of supply chains—spanning software, hardware, cryptography, quantum computing, and artificial intelligence—has created new layers of cybersecurity risk.
Recognizing this, the Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology (MeitY), released “Technical Guidelines on SBOM | QBOM & CBOM | AIBOM | HBOM — Version 2.0” dated 09 July 2025.
This landmark document aims to bring transparency, traceability, and accountability across every layer of the digital supply chain. It expands the traditional Software Bill of Materials (SBOM) concept into a comprehensive framework that now includes quantum, cryptographic, AI, and hardware components.
While the guidelines are currently voluntary, they represent a significant step toward mandatory digital supply-chain security standards in India.
The Concept of a “Bill of Materials” in Cybersecurity
A Bill of Materials (BOM) is essentially an inventory or “ingredient list” that describes every component making up a product.
In manufacturing, a BOM lists the parts of a physical product. In cybersecurity, the same concept applies — but to software, algorithms, datasets, and devices.
Having a detailed BOM helps organisations answer vital questions:
- What components make up our software or hardware?
- Where did they come from?
- Are any of them vulnerable or outdated?
- What licences or restrictions apply?
- How do we verify their integrity?
By maintaining these inventories, organisations can quickly assess exposure when new vulnerabilities or supply-chain attacks are discovered.
Why CERT-In Introduced the Guidelines
Cyberattacks on SolarWinds, Log4j, and Kaseya have demonstrated how deeply concealed weaknesses in dependencies can affect entire ecosystems.
India’s digital infrastructure—which includes government, finance, key industries, and startups—is heavily reliant on imported software libraries, open-source code, and third-party hardware.
CERT-In’s new guidelines therefore aim to:
- Strengthen national cybersecurity resilience.
- Standardize BOM creation and management practices.
- Promote supply-chain transparency and accountability.
- Align Indian practices with emerging international norms (like U.S. Executive Order 14028).
- Prepare Indian industries for quantum-safe and AI-governed futures.
Overview of the Five BOM Frameworks
The guidelines define five complementary BOM categories, each addressing a different domain of the digital supply chain.
1️. Software Bill of Materials (SBOM)
The SBOM is the foundational concept—an itemized list of all components, libraries, and modules within a software product.
Key elements of an SBOM include:
- Component name and version
- Supplier or source
- Dependency relationships
- Hashes/checksums
- Licence and copyright information
- Update and vulnerability references
Why it matters:
SBOMs help developers and users identify vulnerabilities quickly when a flaw is disclosed in a dependency (for example, a vulnerable open-source library).
CERT-In recommendations:
- Integrate SBOM generation into every stage of the SDLC (Design → Build → Deploy → Maintain).
- Use machine-readable formats like SPDX or CycloneDX.
- Link SBOMs with vulnerability-exchange formats such as VEX or CSAF.
- Share SBOMs securely with customers and regulators, maintaining confidentiality where needed.
By adopting SBOMs, organisations build visibility into their software stack—turning “black-box” software into transparent, manageable assets.
2️. Cryptographic Bill of Materials (CBOM)
The CBOM focuses on tracking cryptographic components—algorithms, keys, protocols, and libraries—that underpin secure communication and data protection.
CBOM objectives:
- Document all cryptographic primitives used in software and hardware.
- Track lifecycle of keys, certificates, and algorithm updates.
- Identify weak or deprecated algorithms (e.g., MD5, SHA-1).
- Support migration to modern or quantum-safe alternatives.
This is critical for ensuring crypto-agility, allowing quick transitions when vulnerabilities are found or when quantum-resistant algorithms become mandatory.
3️. Quantum Bill of Materials (QBOM)
Quantum computing is no longer theoretical—it poses real challenges to cryptography and data security.
The QBOM prepares organisations for a quantum-ready future by cataloguing all quantum-related components, including:
- Quantum hardware and processors
- Quantum communication devices
- Quantum-safe cryptographic algorithms
- Simulation frameworks and hybrid classical-quantum models
The goal is to enable risk assessment, ensure interoperability, and support national strategies for quantum-resilient cybersecurity.
4️. Artificial Intelligence Bill of Materials (AIBOM)
AI systems are complex: they depend on data, models, training pipelines, and algorithms that evolve continuously.
The AIBOM is a novel concept that introduces visibility and governance into the AI lifecycle.
Key inclusions:
- AI model name, version, and architecture
- Training datasets, sources, and licensing
- Pre-processing and feature-engineering steps
- Frameworks and libraries used (e.g., TensorFlow, PyTorch)
- Validation metrics and explainability records
- Known biases or limitations
Purpose:
- Promote accountability and transparency in AI systems.
- Mitigate risks of bias, data poisoning, and model manipulation.
- Support audits, ethical reviews, and regulatory compliance.
AIBOMs enable organisations to treat AI systems not as mysterious “black boxes,” but as well-documented, traceable digital assets.
5️. Hardware Bill of Materials (HBOM)
While software dominates headlines, hardware vulnerabilities—such as malicious chips, firmware backdoors, or counterfeit parts—can be equally destructive.
HBOMs document every hardware component and embedded firmware within a device, including:
- Component name and manufacturer
- Model, serial, and firmware version
- Origin and supply-chain traceability
- Known vulnerabilities and patch levels
By maintaining HBOMs, manufacturers and buyers can detect tampered or counterfeit components, ensure authenticity, and manage lifecycle vulnerabilities.
Implementation Guidance
CERT-In’s Version 2.0 guidelines outline a multi-stage approach for organisations to integrate BOM management effectively.
1. Establish governance
- Assign responsibility to a dedicated BOM Management Officer or team.
- Define roles for developers, security teams, and procurement managers.
2. Use standardized formats
- Adopt open formats such as SPDX or CycloneDX for SBOMs.
- For AI and hardware, follow emerging schema defined in the CERT-In annexures.
3. Integrate automation
- Embed BOM generation into CI/CD pipelines to keep inventories current.
- Automate comparison and versioning for patches or new builds.
4. Secure distribution
- Manage BOM access via digital signatures and encrypted repositories.
- Control sharing levels: internal, customer, or regulator.
5. Link to vulnerability management
- Map BOM components to vulnerability databases (like NVD).
- Update BOMs when vulnerabilities are disclosed or components are replaced.
6. Maintain audit trails
- Retain versioned histories of BOMs for compliance and investigations.
- Document approvals, reviews, and change control.
Strategic Importance for India
These guidelines are more than technical documentation—they represent a policy shift in how India views digital infrastructure.
- National Security: BOMs strengthen visibility across imports and domestic production, mitigating supply-chain espionage risks.
- Compliance Readiness: Future regulatory mandates (for government procurement, telecom, or critical infrastructure) may require certified BOMs.
- Global Alignment: By aligning with global standards, Indian software and hardware exporters improve trustworthiness internationally.
- Cyber Resilience: Faster vulnerability response and patch management become achievable through structured BOMs.
For developers and manufacturers, this framework signals a clear expectation: security through transparency.
Challenges Ahead
While visionary, implementing BOMs across sectors brings real challenges:
- Complexity: Large software and AI systems may include thousands of components.
- Confidentiality: Vendors must balance transparency with intellectual property protection.
- Consistency: Suppliers across the chain must adopt compatible formats.
- Maintenance: Keeping BOMs updated during agile releases or AI retraining cycles is resource-intensive.
- Awareness: Many small and medium enterprises (MSMEs) will need training and tooling support.
CERT-In acknowledges these hurdles and encourages phased adoption, capacity-building, and open-source tool ecosystems.
The Road Ahead
As cyber threats evolve, visibility will become the cornerstone of defense.
In the near future, BOM compliance is expected to become:
- A requirement in government and defense procurement tenders.
- A best-practice in cybersecurity audits and risk assessments.
- A trust signal for technology exporters and SaaS providers.
Organisations that start building SBOMs, CBOMs, AIBOMs, and HBOMs today will be better positioned to demonstrate security maturity and regulatory readiness tomorrow.