A car plant has two software supply chains. One runs the factory: robots, controllers and line software. The other ships inside every vehicle: the firmware on its control units. An SBOM helps with both, but different standards frame each, IEC 62443 and NIST SP 800-82 for the plant, and UN Regulation 155 for the vehicle.
This post describes no incident at any manufacturer. It separates two questions that are often mixed up, and it leaves safety decisions to the engineers responsible for the plant and the product.
Side one: the factory floor
Production lines are operational technology. NIST SP 800-82 Revision 3, from September 2023, covers OT security and notes that OT systems have their own performance, reliability and safety requirements. It lists industrial control systems, building automation and other programmable systems that interact with the physical world.
The ISA/IEC 62443 series gives requirements for industrial automation and control systems, split across four groups: asset owners, product suppliers, integrators and service suppliers. For a car maker, the manufacturer is usually the asset owner, and the robot and controller vendors are product suppliers. Integrators fit the lines together.
What an SBOM adds here is a record, per machine, of the firmware and libraries inside it. When a library vulnerability is announced, you want to answer "which robot cells contain it?" quickly. You also want to avoid blind patching, since a change to a line controller has to be tested before it goes live.
Side two: the vehicle
Cars carry many electronic control units, each with firmware from suppliers who in turn use open source and third party code. UN Regulation No. 155 concerns the approval of vehicles with regard to cyber security and cybersecurity management systems. The EUR-Lex record we found lists a consolidated text as in force, and notes that only the original UN texts have legal effect.
Sources we read describe the regulation as requiring a cybersecurity management system that covers development, production and post production before approval. They disagree on dates and on how far supplier obligations extend, so read the UNECE text itself before drawing conclusions. We could not open it.
For the vehicle, an SBOM per software release of each control unit lets a manufacturer answer, after a vulnerability notice, which models and software versions are affected. It is an input to a management system, not a substitute for one.
Why keep the two apart?
The risk, the owner and the response differ.
- A vulnerability on the factory floor is an uptime and safety issue for the plant, fixed by the plant's team inside a maintenance window.
- A vulnerability in a vehicle component is a product security matter, which may involve updates to cars already on the road and supplier coordination.
An inventory that mixes them confuses both. Keep separate registers and link them only where they truly connect, for example a test rig that runs the same code as the car.
What good looks like
- Every plant device has a record with firmware version, owner, network zone and SBOM reference.
- Every vehicle software release has an SBOM and a supplier list.
- New advisories are matched against both registers on a schedule.
- Contracts require suppliers to provide SBOMs and advisory notices.
- Fix decisions are made with the people who own safety and quality.
Where Safeguard fits
Safeguard validates and scans SBOMs in SPDX and CycloneDX form, and its CLI scans source directories, repositories and container images, which suits the software you build or configure around machines and in vehicle components. Its continuous scanning documentation describes rescanning when vulnerability data changes. It does not run on a robot controller or an electronic control unit, and it does not provide type approval or any certification.
What to do
- Decide which register comes first, plant or product, and start small.
- Ask each supplier for an SBOM and an advisory contact.
- Store SBOMs by device or release with a clear owner.
- Match advisories weekly and record decisions, including "accepted".
- Read NIST SP 800-82 and the IEC 62443 overview with plant engineering, and the UN R155 text with product security.
Quick check
Does UN R155 apply to factory robots?
No. The sources we read describe it as covering vehicle approval and cybersecurity management for vehicles. Factory equipment falls under frameworks such as IEC 62443.
Is an SBOM enough for compliance?
No. It is an inventory that supports risk management and response. Standards expect a wider management system around it.
Sources
- NIST SP 800-82 Rev. 3, fetched 18 October 2026
- ISA: ISA/IEC 62443 series of standards, fetched 18 October 2026
- EUR-Lex: UN Regulation No. 155 record, found by search 18 October 2026
- Safeguard CLI documentation, fetched 18 October 2026
Last reviewed: 18 October 2026.
