Article
What changed
On July 29, the Cybersecurity and Infrastructure Security Agency and partner agencies in the U.S. and abroad released joint guidance on the minimum elements of a software bill of materials, or SBOM. An SBOM is an inventory of every component inside a software product, including third-party and open-source libraries. The new guidance updates and replaces the minimum elements the National Telecommunications and Information Administration proposed in 2021, and notes that cloud-based software-as-a-service may require additional elements.
For medical devices, SBOMs are already a legal requirement. Section 524B of the Federal Food, Drug, and Cosmetic Act requires manufacturers to provide one with new device applications submitted to the FDA after Oct. 1, 2023.
Why it matters for hospitals
Scott Gee, the American Hospital Association’s deputy national advisor for cybersecurity and risk, pointed to a medical imaging device as an example: a deeply embedded component with an unpatched vulnerability could lead to compromise of both the device and the hospital network.
That risk fits what the FBI has been telling the field. In a July 27 post, AHA national cybersecurity advisor John Riggi relayed FBI warnings that attackers commonly enter through end-of-life devices, unpatched systems, weak remote access and credentials without multifactor protection. The FBI estimates that adversaries can stay undetected in healthcare environments for an average of 270 days, and that roughly 95% of breaches exploit at least one weakness covered by its top 10 recommended controls.
Putting SBOMs to work
Receiving an SBOM is only the first step. Leaders can make the data useful:
- Procurement: Make a current SBOM that meets the updated minimum elements a contract requirement for new devices and clinical software, along with a commitment to update it when components change.
- Inventory: Link SBOM data to the clinical engineering asset inventory so security teams can quickly find which devices contain a newly disclosed vulnerable component.
- Lifecycle: Use SBOMs to identify devices running end-of-life software and set retirement or isolation dates.
- Vendor management: Ask suppliers how fast they patch high-risk components and how they notify customers.
- Governance: Report to the board how many connected devices have SBOMs on file and how many carry known unpatched vulnerabilities.
An SBOM does not fix anything by itself. Its value comes from the speed it adds when a new vulnerability is announced and the question is which devices are exposed.
Archive entry for Aug 4, 2026, added Nov. 11, 2026.