SBOM mandates outran the machinery that would make them useful

Allan Friedman, who led the NTIA process that published SBOM minimum elements on 12 July 2021, told SecurityWeek that software is assembled from other software and that supplier maturity shows up when a vendor can name its components during a Log4Shell-class event. CVE-2021-44228 carried a CVSS of 10.0 and was actively exploited; the library lived inside products whose vendor name never appeared on the advisory. The podcast’s correction is the right one: an SBOM that cannot be queried is a filing, not a control.

The document trail predates the podcast. Executive Order 14028, signed 12 May 2021, directed SBOMs for software sold to the U.S. government. NTIA’s minimum elements fixed seven fields: supplier, component name, version, unique identifiers, dependency relationship, data author, and timestamp. OMB Memorandum M-22-18, 14 September 2022, made agencies the intended consumer for critical software. Official language says SBOM feeds vulnerability management and procurement. Independent practice still looks like a static file. SPDX, ISO/IEC 5962, and CycloneDX both satisfy the letter; neither guarantees a queryable graph.

Friedman is right that presence is not exploitability, and VEX is the machine-readable status layer CISA has pushed: not affected, affected, fixed, under investigation. That is the piece buyers need after an SBOM match, and the piece vendors ship least. Coverage also misses a harder limit. CVE-2024-3094, the XZ Utils backdoor, was not an outdated library with a published score. It was a malicious upstream change. An accurate SBOM would have named xz; it would not have flagged intent. Component transparency is not compromise detection.

AI BOMs extend the same logic to models, datasets, and tooling. CycloneDX already carries an ML-BOM profile; SPDX is adding model and dataset fields. Friedman treats this as the next transparency surface, which is directionally correct and operationally early. A model card is not a bill of materials, and an AI BOM without identifiers for weights, data provenance, and serving libraries repeats the SBOM failure mode: documents without a consumer. Watch contract clauses, not podcasts. Absent machine-readable AI component requirements in federal solicitations through fiscal 2026, the acronym outruns the control.