# Compliance articles

## Pages

- [Announcing sbomify v26.9.0: The One That Speaks SPDX 3](https://sbomify.com/2026/09/24/announcing-sbomify-v26-9-0-the-one-that-speaks-spdx-3/) (2026-09-24): sbomify v26.9.0 makes SPDX 3 a first-class format end to end, ships a v2 API that calls things what the product calls them, adds a Helm chart for self-hosting on Kubernetes, puts certification badges and CSAF 2.0 discovery on the Trust Center, and rebuilds vulnerability browsing around a real findings table.
- [The CRA Single Reporting Platform Opens Tomorrow: What ENISA Actually Requires](https://sbomify.com/2026/09/10/cra-single-reporting-platform-enisa-srp/) (2026-09-10): ENISA's CRA Single Reporting Platform goes live on 11 September 2026 with Article 14 reporting obligations. Registration, Assigned Representative roles, the 24/72-hour clocks, CSIRT selection, and the fields you will be typing.
- [Announcing sbomify v26.8.0: The One With Security Advisories](https://sbomify.com/2026/08/25/announcing-sbomify-v26-8-0-the-one-with-security-advisories/) (2026-08-25): sbomify v26.8.0 adds full security advisory publishing with per-product gating, a rebuilt Trust Center, patch SLA targets and CRA KPIs, formal risk acceptance, malicious package detection, CSV evidence exports, and a new brand.
- [BSI TR-03183 Is Now Four Documents, and the CRA Clock Runs Out in Three Weeks](https://sbomify.com/2026/08/20/bsi-tr-03183-four-parts-cra-update/) (2026-08-20): BSI published TR-03183-1 in version 1.0.0 on 31 July 2026, completing a four-part CRA guideline family. Here is what changed across TR-03183, the Commission's July 2026 guidance, and the ENISA Single Reporting Platform before 11 September.
- [ENISA's New Healthcare Procurement Guidelines Ask for SBOMs Without Saying the Word](https://sbomify.com/2026/07/23/enisa-healthcare-procurement-guidelines/) (2026-07-23): ENISA's July 2026 procurement guidelines for hospitals and healthcare providers require supply chain transparency, component listings, and vulnerability management. Here is how SBOMs satisfy them.
- [Announcing sbomify v26.7.0: The One That Gets Quantum-Ready](https://sbomify.com/2026/07/07/announcing-sbomify-v26-7-0-the-one-that-gets-quantum-ready/) (2026-07-07): sbomify v26.7.0 adds Cryptography BOM (CBOM) support with NIST-grounded post-quantum readiness assessment, per-token API rate limiting with audit logging, a rebuilt authorization layer, and a broad security hardening pass.
- [Announcing sbomify v26.3.0: The One That Ditches the Token](https://sbomify.com/2026/06/12/announcing-sbomify-v26-3-0-the-one-that-ditches-the-token/) (2026-06-12): sbomify v26.3.0 adds GitHub Actions OIDC trusted publishing so you can push SBOMs with no long-lived API token, expires personal access tokens by default, removes the Project layer, and ships a broad security and access-control hardening pass.
- [Announcing sbomify v26.2.0: The One That Signs the DoC](https://sbomify.com/2026/05/13/announcing-sbomify-v26-2-0-the-one-that-signs-the-doc/) (2026-05-13): sbomify v26.2.0 completes the EU CRA workflow with a signed Declaration of Conformity, adds Component Lifecycle Events, SBOM signatures and provenance, and full CycloneDX 1.7 / SPDX 3.0.1 support.
- [Announcing sbomify v0.26: The One Where Bootstrap Moved Out](https://sbomify.com/2026/02/16/announcing-sbomify-v0-26-the-one-where-bootstrap-moved-out/) (2026-02-16): sbomify v0.26 delivers a faster, more accessible UI, real-time dashboard updates, BSI TR-03183-2 compliance, and GDPR self-service account deletion.
- [The Role of SBOMs in Cybersecurity: From Visibility to Vulnerability Response](https://sbomify.com/2026/02/08/sbom-cybersecurity-role/) (2026-02-08): Learn how SBOMs strengthen cybersecurity through component visibility, vulnerability management, incident response, and compliance with EO 14028, EU CRA, and more.
- [Announcing sbomify-action v0.13: The One Where We Go to FOSDEM](https://sbomify.com/2026/02/04/announcing-sbomify-action-v0-13-the-one-where-we-go-to-fosdem/) (2026-02-04): sbomify-action v0.13 brings hash enrichment from lockfiles, an interactive configuration wizard, Conan Center integration for C/C++, and improved NTIA compliance with supplier fields and PURL generation from VCS URLs.
- [Announcing sbomify v0.25: The One with Attestations](https://sbomify.com/2026/01/23/announcing-sbomify-v0-25-the-one-with-attestations/) (2026-01-23): sbomify v0.25 introduces GitHub Attestation verification via Sigstore/cosign, SPDX 2.3 export, product lifecycle tracking, and compliance badges.
- [The MIT License: A Complete Guide for Developers](https://sbomify.com/2026/01/22/mit-license-guide/) (2026-01-22): Understand the MIT License – what it permits, what it requires, how it compares to BSD and Apache 2.0, and how SBOMs help track MIT license compliance.
- [SBOM Management: How to Organize, Track, and Act on Your SBOMs](https://sbomify.com/2026/01/18/sbom-management-best-practices/) (2026-01-18): Learn how to manage SBOMs across the full lifecycle – from generation and storage to vulnerability monitoring, versioning, and distribution to consumers.
- [Announcing sbomify v0.24: The One with All the Plugins](https://sbomify.com/2026/01/14/announcing-sbomify-v0-24-the-one-with-all-the-plugins/) (2026-01-14): sbomify v0.24 introduces a powerful plugin-based assessment framework supporting security, license, compliance, and attestation plugins. Ships with NTIA, CISA, CRA, and FDA compliance plugins out of the box.
- [FDA Medical Device SBOM Requirements: What the New Cybersecurity Guidance Means for Manufacturers](https://sbomify.com/2026/01/09/fda-medical-device-sbom-requirements/) (2026-01-09): Breakdown of the FDA's June 2025 guidance on medical device cybersecurity, explaining SBOM requirements, premarket submission expectations, and compliance strategies.
- [Apache License 2.0: What It Is, How It Works, and What It Means for Your Software](https://sbomify.com/2026/01/07/apache-license-2-guide/) (2026-01-07): Understand the Apache License 2.0, its patent grant, attribution requirements, NOTICE file, compatibility with GPL, and how SBOMs track compliance.
- [CRA Explained: What the Cyber Resilience Act Means for Device Manufacturers](https://sbomify.com/2026/01/06/cra-explained-cyber-resilience-act-for-device-manufacturers/) (2026-01-06): Podcast episode with EU CRA expert Sarah Fluchs explaining SBOM requirements, the 5-year support mandate, and vulnerability management for device manufacturers.
- [The GPL License: A Comprehensive Guide to the GNU General Public License](https://sbomify.com/2025/12/22/gpl-license-guide/) (2025-12-22): Understand the GPL license, including GPL v2 vs v3, copyleft obligations, LGPL, AGPL, commercial use, and how SBOMs track GPL compliance.
- [Software Development Life Cycle (SDLC): A Complete Guide](https://sbomify.com/2025/12/15/software-development-life-cycle-sdlc-sbom-integration/) (2025-12-15): Learn what the Software Development Life Cycle (SDLC) is, its phases and models, and how SBOMs integrate into each stage for security and compliance.
- [The Role of SBOMs in an OBOM: Ensuring Compliance and Security in Smart Thermometer Development](https://sbomify.com/2024/07/09/the-role-of-sboms-in-an-obom-ensuring-compliance-and-security-in-smart-thermometer-development/) (2024-07-09): How to integrate SBOMs into Operations Bill of Materials (OBOM) for IoT devices, using a smart thermometer example with Python backend, Docker, and Rust firmware.
- [Call for Views on the Code of Practice for Software Vendors: Ensuring Security and Resilience](https://sbomify.com/2024/05/26/call-for-views-on-the-code-of-practice-for-software-vendors-ensuring-security-and-resilience/) (2024-05-26): UK government launches consultation on voluntary Code of Practice for Software Vendors to enhance security and resilience of digital products sold to businesses.
- [NIST Cybersecurity Framework (CSF) 2.0: What It Means for Software Supply Chain Security](https://sbomify.com/2024/04/11/introducing-the-nist-cybersecurity-framework-csf-2-0/) (2024-04-11): A practical guide to NIST CSF 2.0, its six core functions including the new GOVERN function, and how SBOMs support CSF 2.0 implementation for supply chain risk management and vulnerability monitoring.
- [The Time is Now: Embracing SBOMs in an Era of Enhanced Cybersecurity Standards](https://sbomify.com/2024/04/03/the-time-is-now-embracing-sboms-in-an-era-of-enhanced-cybersecurity-standards/) (2024-04-03): Why 2024-2026 is the critical window for SBOM adoption. From EO 14028 and the EU Cyber Resilience Act to PCI DSS 4.0 and FDA guidance, regulatory requirements are converging – and the tooling is ready.
- [SBOM Management for Software Vendors: A Complete Guide to sbomify](https://sbomify.com/2024/04/03/sbomify-a-paradigm-shift-for-software-vendors-in-sbom-management/) (2024-04-03): How software vendors use sbomify to generate compliance-ready SBOMs in CI/CD, enrich them with 11 data sources, attest with GitHub Actions, and share via Trust Center – all from an open source GitHub Action.
- [Navigating the Landscape of Open Source Licenses](https://sbomify.com/2024/04/03/navigating-the-landscape-of-open-source-licenses/) (2024-04-03): Comprehensive guide to open source licenses including MIT, Apache 2.0, GPL, BSD, MPL, and more. Learn the differences between permissive and copyleft licenses and how SBOMs help with license compliance.

---

From sbomify: https://sbomify.com/tags/compliance/