New federal SBOM standards announced today. TicketsCAD already meets them.

[Eric Osterberg]

Good afternoon, TicketsCAD user community,

This morning the Cybersecurity and Infrastructure Security Agency, along with the NSA, the FBI and security agencies from sixteen other countries, published new minimum standards for Software Bills of Materials - the "ingredients list" that tells you what a piece of software is actually built from.

I am writing to tell you that TicketsCAD already meets them, today, the day they were published.

We are releasing the new seventeen-element Software Bill of Materials, and we follow all six of the recommended practices.

CISA called out four new data requirements by name: a cryptographic hash of each component, its license, the name of the tool that produced the list, and the context in which the list was generated. TicketsCAD records all four.

They also emphasised machine-processable formats, so that this can be fed into security tooling rather than read by hand. Ours is published in CycloneDX, an open standard that tools like Dependency-Track, Trivy and Grype read directly.
There is a plain-text copy alongside it for humans.

And they extended the guidance explicitly to open-source software. That is us.
This is a volunteer project, and I would rather we be measured against the same standard as anyone else.

Two further changes are worth your attention.

Our bill of materials now carries a cryptographic signature, so you can confirm the list you are holding came from us and was not altered on the way to you.
You do not have to take my word for that - the instructions to check it yourself ship with the software, and they take about ten seconds.

And the list now goes all the way down. The old standard asked mainly for the components a product uses directly; the new one asks for the whole chain, the components that our components depend on, with no minimum depth. That is a
harder list to produce honestly, and it is the one that actually answers the question you care about when a vulnerability is in the news: "are we affected?"

Where we genuinely cannot determine something - a library that ships with no version recorded anywhere, or a package installed on your own server at run time - the list says so plainly and explains why, rather than guessing. That
is what the new standard asks for, and it is the difference between an inventory you can rely on and one that merely looks complete.

TicketsCAD was updated today to meet all of this.

This project is run by volunteers, for volunteers. We are committed to staying current with leading cybersecurity practice, not eventually, but as it is published. I would encourage the commercial vendors in this space to keep up.

To read the new Software Bill of Materials standards: https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom

For background on Software Bills of Materials generally, from the Cybersecurity and Infrastructure Security Agency:
https://www.cisa.gov/topics/information-communications-technology-supply-chain-security/sbom

To see every third-party component included in TicketsCAD, and to verify the signature yourself:
https://github.com/openises/TicketsCAD/blob/main/SBOM.txt
https://github.com/openises/TicketsCAD

If your department is going through a security review or a procurement process, and you need something from us in a particular format, please ask.
That is what this is for.

- Eric

[Arnie Shore]

Re " ... I am writing to tell you that TicketsCAD already meets them, today, the day they were published."

Eric, all, I am speechless.

AS