ASD ISM 1730Provide a Software Bill of Materials to Consumers
Official control statement
A software bill of materials is produced and made available to consumers of software.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure software users receive a detailed list of included software components.
What this means in practice
A Software Bill of Materials (SBOM) is like a list of ingredients for your software. It tells you what software components and versions are included in any application you use. This is important because knowing what's inside can help identify potential security risks or legal issues, like if a component has vulnerabilities that need to be fixed, which could otherwise lead to hacks or data breaches.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2021
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentTopic
Software bill of materials
Why it matters
Without an SBOM, vulnerabilities in third-party components may be missed, slowing mitigation and increasing breach risk.
Operational notes
Automate SBOM generation in CI/CD and publish it with every release; keep component identifiers/versions consistent across updates.
Implementation tips
- Software developers should create and document an SBOM for each product they develop. They can do this by listing all the libraries and components they use, including open source ones, along with their versions and sources.
- Managers should ensure that the IT team regularly updates the SBOM when changes or updates are made to the software. This can be done by scheduling routine checks and updates after every major release or patch.
- The IT team should work on making the SBOM accessible to consumers, such as clients or users. This could be achieved by including it as part of the user documentation or software packaging.
- Procurement teams should request an SBOM from their software vendors before purchasing software products. This involves contacting the vendor and verifying that the SBOM includes detailed component information.
- Legal and compliance teams should review the SBOM to ensure all components comply with relevant licensing agreements. They can do this by cross-referencing components against known licence databases to spot any compliance issues.
Audit / evidence tips
- AskA copy of the SBOM for a chosen software applicationLook atWhether it lists all components, versions, and sources for each part of the softwareGoodIncludes a complete list with no omissions and accurate details
- Look atThe date of the last update and what changes were trackedGoodIs a recent update log with details on what was changed
- AskA demonstration of how the SBOM is provided to consumersLook atHow easily a consumer can access this information, such as a download link on a customer portalGoodIs an accessible and user-friendly method for consumers
- Look atWhether there are clear guidelines on when and how updates occurGoodIncludes documented procedures adhered to by the software development team
- AskTo see the review process that checks component complianceLook atHow components are verified against licensing restrictionsGoodShows a systematic check, possibly using specialised software or a detailed review checklist
Cross-framework mappings
How ISM-1730 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.25 | ISM-1730 requires that a software bill of materials (SBOM) is produced and made available to consumers of software | |
ISO 42001
| Control | Notes | Details |
|---|---|---|
extensionDepends on(1)expand_less | ||
| Annex A 6.2.7 | Annex A 6.2.7 requires the organisation to provide AI system technical documentation to categories of interested parties (such as consume... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.