Southern Company Builds SBOM for Electric Power Substation

Southern Company presented a case study from S4x24 on building and validating SBOMs for an OT substation, detailing on-site asset inventory, challenges in acquiring SBOMs from 17 vendors, and verification that uncovered missing components and refined thousands of reported issues to a handful of truly exploitable vulnerabilities. The effort demonstrated security and operational value for NERC CIP compliance, vulnerability management, and patch prioritization, and revealed contractual and process gaps in SBOM sharing. Next steps include operationalizing the program and joining a DOE-funded initiative with Schneider Electric, MITRE, Ameren, EPRI, Scythe, and Finite State to automate inventory, SBOM collection, verification, and exploitability analysis.