CISA's SBOM Update Adds Fields but Misses VEX, Accuracy, and Enforcement
Jeff Williams says the rewritten minimum elements add ten fields and a digital signature, yet still omit VEX, accuracy, and any enforcement—while a companion OSS guidance pushes open-source defaults and AI transparency.