Making SBOM mandatory (‘Comply or explain’) to improve transparency, reuse, security and management of software products through greater insight

Rijksoverheid (KOOP / Overheid.nl) · 2026-07-28 · NL · verified record

Themes: Cybersecurity · Data protection · Online platforms · Telecoms & connectivity

Making SBOM mandatory (‘Comply or explain’) to improve transparency, reuse, security and management of software products through greater insight Government In brief An SBOM (Software Bill of Materials) is an overview of all the elements from which software is built. These may include software components, libraries, frameworks and other dependencies that form part of a software product. CycloneDX and SPDX are both SBOM standards that record this information in machine-readable form. At the request of the Ministry of Health, Welfare and Sport, the Standardisation Forum is assessing whether both standards are suitable to be made mandatory for government bodies under the ‘Comply or explain’ policy by placing them on the Standardisation Forum’s ‘Comply or explain’ list under the SBOM registration. The assessment includes expert research. In this public consultation you can respond to the experts’ recommendation, as recorded in the attached Expert Recommendation. Responses to this consultation: 1 public — Anonymous.…