CISA HBOM Framework Doesn't Go Far Enough

The article critiques CISA’s voluntary HBOM framework for stopping at manufacturing and urges end-to-end lifecycle tracking of semiconductor components to improve supply-chain security and vulnerability response. Using the Downfall CPU flaw as an example, it argues that long-lived hardware and late-emerging vulnerabilities require visibility into where chips are deployed so organizations can rapidly assess exposure and mitigate risk, complementing SBOM efforts for comprehensive product security.