Compliance & regulations
The regulations driving SBOM adoption, and how TraceGuard helps.
SBOMs have moved from best-practice to expectation. This page summarizes the main drivers and how TraceGuard supports them.
TraceGuard helps you produce the visibility and evidence these regimes ask for. It is not a certification, and using it doesn't by itself make you compliant — your obligations depend on your products, sector, and jurisdiction. Treat this as orientation, not legal advice.
The regulatory landscape
| Regime | Region | What it expects (in brief) |
|---|---|---|
| Cyber Resilience Act (CRA) | EU | Security-by-design for products with digital elements, vulnerability handling, and an SBOM for the products you place on the market. |
| NIS2 | EU | Supply-chain risk management and incident handling for essential/important entities. |
| ISO/IEC 27001 | Global | An ISMS with asset management, vulnerability management, and evidence of control operation. |
| US Executive Order 14028 / NTIA | US | SBOMs for software sold to the federal government, following the NTIA "minimum elements". |
| FDA premarket guidance | US | An SBOM and vulnerability management plan for medical devices. |
The NTIA minimum elements
A widely-referenced baseline for "what a useful SBOM contains":
- Supplier, component name, and version.
- Unique identifiers and dependency relationships.
- SBOM author and timestamp.
TraceGuard's parsing normalizes CycloneDX and SPDX into this shape, so your inventory carries these elements regardless of how the SBOM was produced.
How TraceGuard helps
- Continuous SBOMs across every project — not a one-time document.
- Vulnerability management with KEV/EPSS prioritization and a triage workflow.
- VEX to communicate exploitability with justifications.
- Assurance & evidence — an append-only log, snapshots, and exportable evidence bundles backed by a tamper-evident audit log, so you can show your posture on demand.
- Crypto BOMs (
cbom) to support crypto-agility expectations.
See Security & compliance for how TraceGuard protects your data, and Assurance & evidence for producing proof.