ENISA Good Practices

EU Agency for Cybersecurity SBOM practices: machine-readable SBOM, component inventory.


Short name	ENISA
Region	Europe
Country or scope	European Union
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ENISA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for ENISA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for ENISA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ENISA-GP-SBOM` Machine-Readable SBOM	Organisations should produce and consume SBOMs in standard machine-readable formats to enable automated supply-chain risk analysis (ENISA Good Practices for Supply Chain Cybersecurity - SBOM recommendations)	Scan
`ENISA-GP-INV` Component Inventory	Suppliers and customers should maintain an inventory of the software components in their products and estates as the foundation of supply-chain risk management (ENISA supply chain guidance - asset and component inventory)	Scan
`ENISA-GP-DEP` Dependency Visibility	Understanding transitive exposure requires documenting the dependency relationships between components, not only listing them (ENISA supply chain guidance - dependency transparency)	Scan
`ENISA-GP-SUP` Supplier Identification	Supply-chain risk assessment requires knowing which supplier stands behind each component so supplier assurance practices can be applied (ENISA Good Practices - supplier relationship management)	Scan
`ENISA-GP-VULN` Vulnerability Correlation Data	SBOM-driven vulnerability management requires component versions and standard identifiers so advisories can be matched automatically (ENISA guidance on SBOM-based vulnerability management)	Scan
`ENISA-GP-PROV` SBOM Provenance	SBOMs used as assurance evidence should record who generated them and when, so consumers can judge freshness and trustworthiness (ENISA supply chain guidance - SBOM quality attributes)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ENISA-SBOM-1`	Produce Machine-Readable SBOM in Approved Format
`ENISA-SBOM-2`	Achieve SBOM Completeness for All Components
`ENISA-SBOM-3`	Include Package URLs (PURLs) in SBOM
`ENISA-SBOM-4`	Include Cryptographic Hashes for SBOM Integrity
`ENISA-SBOM-5`	Correlate SBOM with Vulnerability Databases
`ENISA-SBOM-6`	Include Licence Information for All Components
`ENISA-SBOM-7`	Maintain SBOM Provenance and Authorship Metadata
`ENISA-SBOM-8`	Integrate SBOM into CI/CD Pipeline
`ENISA-SBOM-9`	Share SBOMs with Downstream Customers and Regulators
`ENISA-SBOM-10`	Define SBOM Governance and Ownership
`ENISA-SBOM-11`	Produce VEX Statements for Known Vulnerabilities
`ENISA-SBOM-12`	Implement SBOM-Driven Patch Prioritisation

Policy templates

Written for ENISA:

ENISA SBOM Governance and Management Policy
ENISA SBOM-Driven Vulnerability Management Policy

And 22 from the standard set, adapted to ENISA.