OASIS Open's push for a software supply chain standard: All together now?

OASIS Open has launched the OSIM technical committee to create a unifying framework over existing SBOM models (CSAF, CycloneDX, OpenVEX, SPDX) to improve transparency, interoperability, and automation in software supply chain security. Backed by major organizations including Microsoft, Google, NSA, and CISA, the initiative aims to reduce confusion and streamline tooling, though experts caution that standardization alone may not solve operational challenges without stronger context and actionability beyond vulnerability-centric SBOM data.