With reference to the CERT-In Software Bill of Materials (SBOM) guidelines 2025, which of the following statements is/are correct?
1. They mandate essential service providers to maintain a machine-readable inventory of software components to secure the digital supply chain.
2. The guidelines are strictly limited to software and explicitly exclude Artificial Intelligence and cryptographic components.

Question

Accepted Answer

1 only — Statement 1 is correct as the guidelines mandate SBOMs for government and essential services. Statement 2 is incorrect because the 2025 guidelines specifically expanded the scope to include Artificial Intelligence (AIBOM), Cryptographic (CBOM), Quantum (QBOM), and Hardware (HBOM) bills of materials.

CERT-In Issues Software Bill of Materials Guidelines

Conclusion of Budget Session 2026 First Half