IST suggests multistakeholder process to develop shared vision for Hardware Bill of Materials under Energy Dept. bulk power work

The Aug. 26 order directs DOE to create a process to prohibit certain foreign transactions in the bulk power sector in the interest of national security. DOE issued a Sept.

9 request for information to get feedback on implementing the EO. “To successfully implement the EO, the Department of Energy needs more than a list of prohibited entities or countries,” IST writes in an Oct. 15 policy memo.

IST argues, “It needs a sustainable way for manufacturers and their suppliers, asset owners, and government analysts to understand what is inside relevant equipment, where it came from, what remains unknown, and how much confidence to place in that information. Hardware bills of materials, or HBOMs, should therefore be part of the implementation strategy for the EO.” The memo is written by Allan Friedman, senior adjunct technical advisor at IST, and Nick Leiserson, president of IST’s Center for Advancing Cybersecurity. Friedman previously worked at the Cybersecurity and Infrastructure Security Agency where he led efforts to advance Software Bill of Materials initiatives.

Friedman told Inside Cybersecurity the memo is designed to “get serious about building out the infrastructure that can convey a range of hardware supply chain security data, provenance and assurances in a way that can be reused by multiple organizations, foster an ecosystem of commercial or even open source tools and allow companies that meet the needs of multiple sectors to only have to do a single general solution that can be then applied to specific government needs.” The memo says, “DOE should treat the RFI and implementation process as an opportunity to establish the foundation for a durable hardware-transparency ecosystem.” First, IST urges DOE to “leverage convening authority from trusted partners with experience doing this kind of work to convene an open, multistakeholder process with the goal of establishing a common vision and shared definition for HBOM.” “The process should begin with specific use cases and a proposed core: reusable information about physical components, their relationships, and provenance. It should also define the boundaries between HBOM data and linked risk evaluations, functional characteristics, and operational information, while establishing realistic expectations for initial implementation,” the memo says. Friedman led a multistakeholder process on software transparency at the National Telecommunications and Information Administration, which focused on developing a consensus around SBOM topics.

Friedman continued this work when he moved to CISA in 2021 and spearheaded community-led working groups to address different SBOM topics of interest. Friedman said the convening authority could come from a number of places, such as the Defense Department, the national labs or organizations like IST. CISA worked in 2023 with DOE’s Office of Cybersecurity, Energy Security, and Emergency Response to develop guidance on the SBOM sharing lifecycle.

The guidance was written by individuals from the Idaho National Lab, the Pacific Northwest National Lab and CISA. IST also encourages DOE to “build confidential and purpose-specific disclosure” into implementing new requirements from the August EO. The memo says, “DOE should define the information or assurance needed for particular decisions and facilitate industry exploration of technical and institutional disclosure models.

IST’s third recommendation is for the White House to play a coordinating role “across the Federal Government to ensure HBOM initiatives are implemented iteratively.” The memos says, “White House components should align relevant concepts and data requirements with other agencies and sectors, use pilots to test feasibility, and allow requirements to mature as tools and implementation practices improve.” DOE’s Sept.