Strengthening industrial cybersecurity with SBOMs
Modern automation systems rely on complex software stacks that include third-party and open-source components. Ensuring the security and compliance of such systems requires transparency.
A software bill of materials (SBOM) provides exactly that: A complete, machine-readable inventory of all software components used in a product. Think of a parts list in mechanical engineering or an ingredients list on food packaging. It contains:
- Component names and version information
- Vendor identifiers
- Licensing details
- Metadata
Why SBOMs matter for industrial automation
The EU Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for products with digital elements. For machine builders and integrators, SBOMs help with meeting regulatory requirements, assessing security risks and maintaining compliance throughout the lifecycle of their machines and systems.
How B&R handles SBOMs
B&R focuses on compliance with legal requirements and lists the third-party components and (open source) licenses used for this purpose. We monitor and analyze the various recommendations issued by global authorities and organizations such as ENISA, CISA and the BSI. B&R evaluates the wide range of recommendations to establish a consolidated foundation for SBOMs without introducing excessive complexity.
B&R already creates SBOMs as part of our certified secure product development lifecycle according to IEC 62443-4-1. This means we were prepared for SBOM requirements long before the CRA made them mandatory.
Our approach
Industry standard formats
We use the CycloneDX standard, ensuring interoperability with common vulnerability analysis platforms.
First-level dependencies
B&R SBOMs cover the direct dependencies of our products as well as the components we integrate and are responsible for.
Continuous vulnerability monitoring
SBOMs enable us to systematically monitor for third-party component vulnerabilities and report them.
License transparency
Our SBOMs provide full visibility into open-source licenses used by B&R products.
Creating SBOMs for your machine application
As a machine builder, you need to document the software components in your application. The tooling depends on your technology stack and industrial automation brings unique challenges compared to typical IT environments.
Community solutions available today
Community-driven tools already cover different stages of the machine lifecycle. Together, these tools cover both the engineering phase and the as-built state of deployed systems, a critical distinction for lifecycle compliance.
SBOM for Automation Studio 6 projects (design time)
The Python-based SBOM Generator for Automation Studio 6 Projects scans your AS6 project structure and produces CycloneDX JSON SBOMs for the configuration. It reads project information from Logical, Physical and APJ data, referencing all used B&R components.
SBOM from SDM system dumps (runtime / field)
A toolkit that processes SDM system dumps from live systems and generates CycloneDX SBOMs along with system evidence bundles. It extracts hardware information (serial numbers, firmware versions, hardware variants), normalizes diagnostic logs and can verify SDM package authenticity even for dumps transported via USB flash drives or other media.
Looking ahead
B&R is working toward integrated SBOM capabilities within the development environment. The goal is to make SBOM generation a seamless part of the engineering workflow reducing manual effort and ensuring consistency across the entire project lifecycle.
Why you don't need to manage our SBOMs
Each manufacturer is responsible for their own level in the supply chain. What this means for you:
B&R monitors and patches vulnerabilities
in all components used in our products. You don't need to monitor or patch individual subcomponents inside B&R software.
You can focus on your direct dependencies:
As a machine builder, your SBOM documents the components you directly integrate including B&R products as individual entries.
Practical reality:
Even if you had full visibility into every nested dependency within a B&R product, you wouldn't have the ability to patch or replace individual subcomponents independently. That responsibility stays with B&R.
With this approach, the supply chain becomes manageable and scalable through the significant number of vulnerabilities we're all facing.
SBOMs and CRA compliance
SBOMs play an essential role in demonstrating compliance with several CRA obligations:
Cybersecurity by design
- SBOMs provide evidence of structured component management during development.
- B&R's IEC 62443-4-1-certified development process ensures that all information necessary for complete SBOMs is maintained from the start.
Vulnerability handling and reporting
- B&R monitors security advisories and vulnerability databases to identify potential risks in software components.
- For current security information, visit our Cybersecurity Advisories and Notices page.
Documentation obligations
- SBOMs contribute to transparent technical documentation and lifecycle support.
- This meets CRA and IEC 62443 regulations.
Closing the loop
While the CRA focuses heavily on manufacturers, SBOMs benefit the entire supply chain. Modern cybersecurity programs increasingly rely on automated vulnerability analysis platforms such as Dependency-Track or similar solutions. These systems take SBOMs and continuously monitor them against public vulnerability databases.
This closes the loop between SBOM creation, vulnerability monitoring and product lifecycle security at every level of the supply chain and is handled by the responsible party.