Blue Goat CyberBlue Goat CyberSMMedical Device Cybersecurity
    All infographics
    SBOM

    The medical device SBOM lifecycle

    The six repeating steps that keep a medical device SBOM useful after submission: build, identify, monitor, triage, fix, and update.

    Infographic loop of six steps: build the SBOM from the build, identify components with PURL and CPE, monitor NVD, CISA KEV, and vendor advisories, triage with VEX, fix, and release an update with a new SBOM.
    An SBOM is a living record, not a one-time submission file. Repeat the loop for every release.
    Download the graphicTalk through it with us

    What the graphic says

    The full text version, so the content is readable without the image.

    Six repeating steps

    1. Build
    Generate the SBOM from the build, not by hand.
    2. Identify
    Give each component a PURL and, where available, a CPE.
    3. Monitor
    Check NVD, CISA KEV, and vendor advisories.
    4. Triage
    Decide if each CVE affects the device and record it in VEX.
    5. Fix
    Patch or apply compensating controls.
    6. Update
    Release the update and a new SBOM version.

    Keep reading

    More in SBOM

    Ready when you are

    Get FDA cleared without the cybersecurity headaches.

    30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.

    Book strategy sessionExplore services