The Case for a SaaS Bill of Material  [[3. Resources/Readwise/Full Document Contents/Articles/The Case for a SaaS Bill of Material|Full Document Contents]] ## Document Notes 1. What are the potential benefits and drawbacks of implementing a SaaS bill of material (SaaSBOM) framework for managing information risk posed by third parties? 2. How do SaaS providers plan to address uncertainties around what components should be included in the SaaSBOM, particularly when it comes to vendor-managed deployment models? 3. How does the proposal for a SaaSBOM framework suggest that vendor information security teams can take a full inventory of the systems their organizations are using and identify and limit shadow IT? The article discusses the importance of software bills of material (SBOMs) in ensuring software supply chain security and the challenges in implementing them for vendor-managed deployment models like software as a service (SaaS). To address this challenge, the authors propose a framework for a SaaS bill of material (SaaSBOM), in which the vendor analyzes the technology stack of each product offering to create a comprehensive list of components. This list could include nested SaaSBOMs or bills of material for other SaaS, PaaS or IaaS providers. The article emphasizes the need for automation in producing, tracking and maintaining SaaSBOMs and recommends the development of a new format for SaaS by organizations such as the Cloud Security Alliance or Cloud Native Computing Foundation. The authors argue that the development of a clear standard for SaaSBOMs is vital in managing information risk posed by third parties in modern software supply chains. Question: What is a SaaSBOM? Answer: A SaaSBOM is a framework proposed to address the challenge of developing a software bill of material for vendor-managed deployment models such as software as a service (SaaS). Question: What is the method for representing components hosted by the vendor in the SaaSBOM? Answer: The existing software package data exchange (SPDX) or software identification (SWID) standards are appropriate for representing components hosted by the vendor itself in the SaaSBOM. Question: Can customers demand contractual guarantees as to the exact composition of the SaaSBOM? Answer: No, customers cannot reasonably demand contractual guarantees as to the SaaSBOM's exact composition, but having some information along with clearly stated gaps is still better than having none. > [!note]+ Document Notes > 1. What are the potential benefits and drawbacks of implementing a SaaS bill of material (SaaSBOM) framework for managing information risk posed by third parties? > 2. How do SaaS providers plan to address uncertainties around what components should be included in the SaaSBOM, particularly when it comes to vendor-managed deployment models? > 3. How does the proposal for a SaaSBOM framework suggest that vendor information security teams can take a full inventory of the systems their organizations are using and identify and limit shadow IT? > > The article discusses the importance of software bills of material (SBOMs) in ensuring software supply chain security and the challenges in implementing them for vendor-managed deployment models like software as a service (SaaS). To address this challenge, the authors propose a framework for a SaaS bill of material (SaaSBOM), in which the vendor analyzes the technology stack of each product offering to create a comprehensive list of components. This list could include nested SaaSBOMs or bills of material for other SaaS, PaaS or IaaS providers. The article emphasizes the need for automation in producing, tracking and maintaining SaaSBOMs and recommends the development of a new format for SaaS by organizations such as the Cloud Security Alliance or Cloud Native Computing Foundation. The authors argue that the development of a clear standard for SaaSBOMs is vital in managing information risk posed by third parties in modern software supply chains. > > Question: What is a SaaSBOM? > Answer: A SaaSBOM is a framework proposed to address the challenge of developing a software bill of material for vendor-managed deployment models such as software as a service (SaaS). > > Question: What is the method for representing components hosted by the vendor in the SaaSBOM? > Answer: The existing software package data exchange (SPDX) or software identification (SWID) standards are appropriate for representing components hosted by the vendor itself in the SaaSBOM. > > Question: Can customers demand contractual guarantees as to the exact composition of the SaaSBOM? > Answer: No, customers cannot reasonably demand contractual guarantees as to the SaaSBOM's exact composition, but having some information along with clearly stated gaps is still better than having none. ## Highlights - we propose a framework for what a SaaS bill of material (SaaSBOM) should look like ([View Highlight](https://read.readwise.io/read/01h49s1vnxb6sgkt6wsc30xhwv)) - To build a SaaSBOM, a vendor would carefully analyze the technology stack upon which the confidentiality, integrity and availability of data in said offering depends ([View Highlight](https://read.readwise.io/read/01h49s3rhw158fyv4z3ekqd9ns)) - [software package data exchange](https://spdx.dev/) (SPDX) ([View Highlight](https://read.readwise.io/read/01h49s4q1x0an2z1kgnab9jgjv)) - [software identification](https://webstore.ansi.org/Standards/ISO/ISOIEC197702015) (SWID ([View Highlight](https://read.readwise.io/read/01h49s4w713xzckvc7v47dm3xd)) - customers cannot reasonably demand contractual guarantees as to the SaaSBOM’s exact composition, some information along with clearly stated gaps is better than none ([View Highlight](https://read.readwise.io/read/01h49s5trecjxzn2tzys5v8w7f))