What an SBOM is, and why it suddenly matters
A software bill of materials (SBOM) is a structured list of the components in a piece of software: open-source libraries, third-party packages and their versions. When a vulnerability in a widely used component is disclosed, an SBOM lets you see within minutes whether and where you are affected, instead of asking every team and supplier by hand. Under NIS2 that speed matters, because Article 23 requires an early warning within 24 hours of becoming aware of a significant incident and an incident notification within 72 hours.
NIS2 does not name the SBOM
The NIS2 directive never uses the word. Article 21(2)(d) requires supply chain security, including the security-related aspects of relationships with direct suppliers, and Article 21(2)(e) requires security in the acquisition, development and maintenance of network and information systems. How you meet those obligations is up to you, provided the measures are appropriate and proportionate.
For one group of entities it gets more concrete. Implementing Regulation (EU) 2024/2690 sets the technical requirements for, among others, providers of cloud computing, data centre and DNS services, managed service and managed security service providers, online marketplaces and trust service providers. Point 6.1.2 of its annex requires their processes for acquiring ICT services and products to include information describing the hardware and software components used in those services or products. That is close to an SBOM in all but name. The implementation guidance ENISA published in June 2025 does not mention SBOMs explicitly; it asks for a documented, standards-based acquisition process.
The Cbw in the Netherlands
In the Netherlands NIS2 applies through the Cyberbeveiligingswet and the Cyberbeveiligingsbesluit. According to the NCSC the law covers more than 8,000 organisations that provide essential or important services. They must register, report significant incidents within 24 hours to the CSIRT and the supervisor, and have management approve and oversee the risk management measures. The SBOM is not named there either; supply chain security is.
The CRA is explicit
The Cyber Resilience Act is the regulation that does require an SBOM, but from manufacturers rather than users. Manufacturers of products with digital elements must identify and document the components of their products, including by drawing up an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026; the main obligations, including the SBOM, from 11 December 2027. CycloneDX and SPDX are the formats most used in practice.
| NIS2 and the Cbw | CRA | DORA | |
|---|---|---|---|
| SBOM named | No; supply chain security and secure acquisition | Yes, for manufacturers | No; part of ICT third-party risk |
| Who | Essential and important entities | Manufacturers of products with digital elements | Financial entities |
| Format | Not prescribed | Commonly used and machine-readable | Not prescribed |
| Applies | Cbw since 15 August 2026 | Reporting from 11 September 2026, main obligations from 11 December 2027 | Since 17 January 2025 |
For financial entities, DORA addresses the same need differently: through ICT third-party risk management and the register of information on contractual arrangements with ICT third-party service providers.
Building it into your management system
Start with an inventory of your software estate, because nobody usually holds the complete list: procurement, development and IT each have part of it. Generate SBOMs first for the systems that support essential or important services; most build tools and container registries can produce CycloneDX or SPDX as part of the release process. Connect the component lists to vulnerability sources, so that a new disclosure shows immediately which systems are affected. Ask new software suppliers to deliver an SBOM as part of the contract, and ask existing suppliers in order of risk. And make the SBOM part of incident response, so the impact assessment for the 24-hour and 72-hour deadlines can use it.
An SBOM made once answers the question for one moment. After new releases, new vulnerabilities and new suppliers, the picture changes. That is why it belongs in your ISMS as a control with an owner, a review frequency and evidence, under the supplier and acquisition controls of ISO 27001 Annex A.
How Basenorm helps
In the Unified Control Library supply chain security is one control, linked to NIS2, ISO 27001, the CRA and DORA, with its owner and evidence attached once. The Governance Graph connects suppliers, assets, risks and controls. AskNorman answers questions about scope and evidence; your team assesses and decides.