5 best practices for putting SBOMs to work with CI/CD

This article presents five best practices for operationalizing SBOMs in CI/CD environments aligned with EO 14028 and NTIA guidance: automate SBOM generation; include comprehensive elements and lifecycle collection context; export in standard formats (CycloneDX, SPDX, SWID); ensure integrity and authenticity using signatures and hashes; and keep SBOMs continuously updated and monitored. It emphasizes integrating SBOM processes into DevOps, using SCA tools, and applying risk-based prioritization so SBOMs remain accurate, actionable, and useful for managing security, licensing, and supply chain risk.