How OSPOs Use SBOMs to Secure the Invisible Software Supply Chain

Supply‑chain security and compliance

Modern applications contain 70‑90 % open‑source code, making manual review impossible. OSPOs must implement automated pipelines that detect vulnerable components and license issues early.

Key concepts

SCA (Software Composition Analysis) tools scan a repository, enumerate each third‑party component, record its version, map known CVEs, and retrieve the declared license. Typical outputs are JSON, CSV, or SPDX‑compatible SBOMs.

SBOM (Software Bill of Materials) is a structured “ingredients list”. U.S. Executive Order 14028 requires an SBOM for government and large‑enterprise deliveries, usually in SPDX or CycloneDX format.

Shift‑left compliance

The goal is to surface violations during IDE coding or at commit time, rather than during release. When resources allow, the pipeline can also be extended downstream (“shift‑right”) to provide developer‑friendly platforms.

Typical automated pipeline

# Example CI step (GitHub Actions)
- name: Run SCA
  uses: dependency-check/action@v2
  with:
    format: "JSON,HTML"
    failOnCVSS: 7
- name: Generate SBOM
  run: |
    syft packages . -o spdx-json > sbom.spdx.json
    cyclonedx-bom -o sbom.cdx.xml
- name: Enforce policy
  uses: policy-check/action@v1
  with:
    sbom: sbom.spdx.json
    allowed-licenses: "MIT,Apache-2.0"

vivo open‑source practice (illustrative)

Built SCA capabilities across code‑commit, build, and ROM‑release stages, achieving zero open‑source security‑compliance risk for client software.

Integrated a simplified SBOM (“open‑source software declaration”) that now covers 84.96 % of client business, ensuring license compliance.

Prepared for upcoming EU SBOM mandates to support overseas product shipments.

Piloting an “open‑source supply‑chain health” practice that moves governance from pure compliance to proactive health checks.

Reference resources

OpenSSF – best practices for software supply‑chain security: https://openssf.org/technical-initiatives/software-supply-chain/

SPDX – ISO standard for describing SBOMs: https://spdx.dev/

OpenChain – open‑source compliance framework: https://openchainproject.org/