CERT-In’s New BOM Guidelines Bolster India’s Digital Security

In July 2025, the Indian Computer Emergency Response Team (CERT-In) released a critical update to its Software Bill of Materials (SBOM) guidelines. These new guidelines, version 2.0, significantly expand the scope to include Artificial Intelligence (AIBOM), Quantum (QBOM), Cryptography (CBOM), and Hardware (HBOM) components.

The enhanced framework aims to increase transparency and traceability across India’s digital supply chains. A Bill of Materials (BOM) provides a detailed inventory of components, allowing organizations to:

• Track Provenance: Document the origin of software, hardware, and AI components.
• Manage Vulnerabilities: Identify and mitigate risks by mapping components to known vulnerabilities (e.g., CVE database).
• Ensure Compliance: Maintain standardized records for audits and regulatory adherence.

The guidelines target a diverse range of stakeholders, including software developers, hardware manufacturers, and developers of AI and quantum systems. CERT-In mandates that BOMs be maintained in both human-readable (PDF/CSV) and machine-readable (JSON/XML) formats to enable secure sharing.

The comprehensive guidelines address the increasing complexity of modern digital threats. With AI and quantum computing introducing new vulnerabilities—such as poisoned datasets and quantum-based cryptographic attacks—AIBOMs and QBOMs provide essential transparency.

By focusing on detailed BOMs, CERT-In aims to strengthen supply chain security. This is particularly crucial given that supply chains are the target of 60% of cyberattacks, according to IBM’s 2024 report. The guidelines also align India with international standards, such as the U.S. Executive Order 14028, positioning the country as a leader in proactive cyber assurance.

While the updated guidelines are a pivotal step, implementing them presents challenges. Small and medium enterprises (SMEs) may struggle with the resources needed for comprehensive BOM adoption. Additionally, the complexity of AI and quantum systems requires specialized expertise, highlighting the need for workforce upskilling.

Despite these hurdles, the guidelines are expected to drive growth in India’s cybersecurity market and enhance trust in Indian technology globally. By ensuring compliance with international standards, the framework supports the “Digital India” initiative and strengthens the nation’s digital infrastructure against evolving threats.