Is your organization's PCI compliance coming up for renewal in 2025? Or are you looking to achieve PCI compliance for the first time?
Version 4.0 of the Payment Card Industry Data Security Standard (PCI DSS) became mandatory on March 31, 2025. For enterprise's utilizing a 3rd-party software software supply chain—essentially all companies, according to The Linux Foundation's report on open source penetration—PCI DSS v4.0 requires companies to maintain comprehensive inventories of supply chain components. The SBOM standard has become the cybersecurity industry's consensus best practice for securing software supply chains and meeting the requirements mandated by regulatory compliance frameworks.
This document serves as a comprehensive guide to understanding the pivotal role of SBOMs in navigating the complexities of PCI DSS v4.0 compliance.
Learn about the role that SBOMs for the security of your organization in this white paper.
Understanding the Fundamentals: PCI DSS 4.0 and SBOMs
What is PCI DSS 4.0?
Developed to strengthen payment account data (e.g., credit cards) security and standardize security controls globally, PCI DSS v4.0 represents the next evolution of this standard; ultimately benefiting consumers worldwide.
This version supersedes PCI DSS 3.2.1, which was retired on March 31, 2023. The explicit goals of PCI DSS v4.0 include promoting security as a continuous process, enhancing flexibility in implementation, and introducing enhancements in validation methods. PCI DSS v4.0 achieved this by introducing a total of 64 new security controls.
NOTE: PCI DSS had a minor version bump to 4.0.1 in mid-2024. The update is limited and doesn't add or remove any controls or change any deadlines, meaning the software supply chain requirements apply to both versions.
Demystifying SBOMs
A software bill of materials (SBOM) is fundamentally an inventory of all software dependencies utilized by a given application. Analogous to a "Bill of Materials" in manufacturing, which lists all raw materials and components used to produce a product, an SBOM provides a detailed list of software components, including libraries, 3rd-party software, and services, that constitute an application.
The benefits of maintaining SBOMs are manifold, including enhanced transparency into the software supply chain, improved vulnerability management by identifying at-risk components, facilitating license compliance management, and providing a foundation for comprehensive supply chain risk assessment.
How SBOMs Address PCI DSS 4.0 Requirements—The Critical Link
PCI DSS Requirement 6: Develop and Maintain Secure Systems and Software
PCI DSS Principal Requirement 6, titled “Develop and Maintain Secure Systems and Software,” aims to ensure the creation and upkeep of secure systems and applications through robust security measures and regular vulnerability assessments and updates. This requirement encompasses five primary areas:
- Processes and mechanisms for developing and maintaining secure systems and software are defined and understood
- Bespoke and custom software are developed securely
- Security vulnerabilities are identified and addressed
- Public-facing web applications are protected against attacks
- Changes to all system components are managed securely
Deep Dive into Requirement 6.3.2: Component Inventory for Vulnerability Management
Within the “Security vulnerabilities are identified and addressed” category of Requirement 6, Requirement 6.3.2 mandates:
An inventory of bespoke and custom software, and 3rd-party software components incorporated into bespoke and custom software is maintained to facilitate vulnerability and patch management
The purpose of this evolving requirement is to enable organizations to effectively manage vulnerabilities and patches within all software components, including 3rd-party components such as libraries and APIs embedded in their bespoke and custom software.
While PCI DSS v4.0 does not explicitly prescribe the use of SBOMs, they represent the cybersecurity industry's consensus method for achieving compliance with this requirement by providing a detailed and readily accessible inventory of software components.
How SBOMs Enable Compliance with 6.3.2
By requiring an inventory of all software components, Requirement 6.3.2 necessitates a mechanism for comprehensive tracking. SBOMs automatically generate an inventory of all components in use, whether developed internally or sourced from third parties.
This detailed inventory forms the bedrock for identifying known vulnerabilities associated with these components. Platforms leveraging SBOMs can map component inventories to databases of known vulnerabilities, providing continuous insights into potential risks.
Consequently, SBOMs are instrumental in facilitating effective vulnerability and patch management by enabling organizations to understand their software supply chain and prioritize remediation efforts.
Connecting SBOMs to other relevant PCI DSS 4.0 Requirements
Beyond Requirement 6.3.2, SBOMs offer synergistic benefits in achieving compliance with other aspects of PCI DSS v4.0.
Requirement 11.3.1.1
This requirement necessitates the resolution of high-risk or critical vulnerabilities. SBOMs enable ongoing vulnerability monitoring, providing alerts for newly disclosed vulnerabilities affecting the identified software components, thereby complementing the requirement for tri-annual vulnerability scans.
Platforms like Anchore Secure can track newly disclosed vulnerabilities against SBOM inventories, facilitating proactive risk mitigation.
Implementing SBOMs for PCI DSS 4.0: Practical Guidance
Generating Your First SBOM
The generation of SBOMs can be achieved through various methods. A Software Composition Analysis (SCA) tool, like the open source SCA Syft or the commercial AnchoreCTL, offer automated software composition scanning and SBOM generation for source code, containers or software binaries.
Looking for a step-by-step "how to" guide for generating your first SBOM? Read our technical guide.
These tools integrate with build pipelines and can output SBOMs in standard formats like SPDX and CycloneDX. For legacy systems or situations where automated tools have limitations, manual inventory processes may be necessary, although this approach is generally less scalable and prone to inaccuracies.
Regardless of the method, it is crucial to ensure the accuracy and completeness of the SBOM, including both direct and transitive software dependencies.
Essential Elements of an SBOM for PCI DSS
While PCI DSS v4.0 does not mandate specific data fields for SBOMs, it is prudent to include essential information that facilitates vulnerability management and component tracking. Drawing from recommendations by the National Telecommunications and Information Administration (NTIA), a robust SBOM should, at a minimum, contain:
- Component Name
- Version String
- Supplier Name
- Unique Identifier (e.g., PURL or CPE)
- Component Hash
- Author Name
Operationalizing SBOMs: Beyond Inventory
The true value of an SBOM lies in its active utilization for software supply chain use-cases beyond component inventory management.
Vulnerability Management
SBOMs serve as the foundation for continuous vulnerability monitoring. By integrating SBOM data with vulnerability databases, organizations can proactively identify components with known vulnerabilities. Platforms like Anchore Secure enable the mapping of SBOMs to known vulnerabilities, tracking exploitability and patching cadence.
Patch Management
A comprehensive SBOM facilitates informed patch management by highlighting the specific components that require updating to address identified vulnerabilities. This allows security teams to prioritize patching efforts based on the severity and exploitability of the vulnerabilities within their software ecosystem.
Maintaining Vulnerability Remediation Documentation
It is essential to maintain thorough documentation of vulnerability remediation efforts in order to achieve the emerging continuous compliance trend from global regulatory bodies. Utilizing formats like CVE (Common vulnerabilities and Exposures) or VEX (Vulnerability Exploitability eXchange) alongside SBOMs can provide a standardized way to communicate the status of vulnerabilities, whether a product is affected, and the steps taken for mitigation.
Acquiring SBOMs from Third-Party Suppliers
PCI DSS Requirement 6.3.2 explicitly includes 3rd-party software components. Therefore, organizations must not only generate SBOMs for their own bespoke and custom software but also obtain SBOMs from their technology vendors for any libraries, applications, or APIs that are part of the card processing environment.
Engaging with suppliers to request SBOMs, potentially incorporating this requirement into contractual agreements, is a critical step. It is advisable to communicate preferred SBOM formats (e.g., CycloneDX, SPDX) and desired data fields to ensure the received SBOMs are compatible with internal vulnerability management processes. Challenges may arise if suppliers lack the capability to produce accurate SBOMs; in such instances, alternative risk mitigation strategies and ongoing communication are necessary.
NOTE: Remember the OSS maintainers that authored the open source components integrated into your application code are NOT 3rd-party suppliers in the traditional sense—you are! Almost all OSS licenses contain an "as is" clause that absolves them of liability for any code quality issues like vulnerabilities. This means that by using their code, you are now responsible for any security vulnerabilities in the code (both known and unknown).
Navigating the Challenges and Ensuring Success
Addressing Common Challenges in SBOM Adoption
Implementing SBOMs across an organization can present several challenges:
- Generating SBOMs for closed-source or legacy systems where build tool integration is difficult may require specialized tools or manual effort
- The volume and frequency of software updates necessitate automated processes for SBOM generation and continuous monitoring
- Ensuring the accuracy and completeness of SBOM data, including all levels of dependencies, is crucial for effective risk management
- Integrating SBOM management into existing software development lifecycle (SDLC) and security workflows requires collaboration and process adjustments
- Effective SBOM adoption necessitates cross-functional collaboration between development, security, and procurement teams to establish policies and manage vendor relationships
Best Practices for SBOM Management
To ensure the sustained effectiveness of SBOMs for PCI DSS v4.0 compliance and beyond, organizations should adopt the following best practices:
- Automate SBOM generation and updates wherever possible to maintain accuracy and reduce manual effort
- Establish clear internal SBOM policies regarding format, data fields, update frequency, and retention
- Select and implement appropriate SBOM management tooling that integrates with existing security and development infrastructure
- Clearly define roles and responsibilities for SBOM creation, maintenance, and utilization across relevant teams
- Provide education and training to development, security, and procurement teams on the importance and practical application of SBOMs
The Broader Landscape: SBOMs Beyond PCI DSS 4.0
As predicted, the global regulatory push toward software supply chain security and risk management with SBOMs as the foundation continues to gain momentum in 2025. PCI DSS v4.0 is the next major regulatory framework embracing SBOMs. This follows the pattern set by the US Executive Order 14028 and the EU Cyber Resilience Act, further cementing SBOMs as a cornerstone of modern cybersecurity best practice.
Wrap-Up: Embracing SBOMs for a Secure Payment Ecosystem
The integration of SBOMs into PCI DSS v4.0 signifies a fundamental shift towards a more secure and transparent payment ecosystem. SBOMs are no longer merely a recommended practice but a critical component for achieving and maintaining compliance with the evolving requirements of PCI DSS v4.0, particularly Requirement 6.3.2.
By providing a comprehensive inventory of software components and their dependencies, SBOMs empower organizations to enhance their security posture, reduce the risk of costly data breaches, improve their vulnerability management capabilities, and effectively navigate the complexities of regulatory compliance. Embracing SBOM implementation is not just about meeting a requirement; it is about building a more resilient and trustworthy software foundation for handling sensitive payment card data.
If you're interested to learn more about how Anchore Enterprise can help your organization harden their software supply chain and achieve PCI DSS v4.0 compliance, get in touch with our team!
Interested to learn about all of the software supply chain use-cases that SBOMs enable? Read our new white paper and start unlocking enterprise value.
