Yes, you can ask machine makers and integrators for a software bill of materials covering controller firmware, operator panel software and any embedded operating system. Many will not have one ready, so make it a contract requirement for new purchases and a written request for installed equipment.
Why would a food plant want this?
Every filler, oven controller and vision system contains software, much of it open source or third party. When a flaw in a common component is announced, the plant owner needs to know which machines contain it. Without a bill of materials, the only route is calling each vendor and waiting.
NIST's guide to operational technology security describes OT as programmable systems that interact with the physical environment, which is exactly what a processing line is. The same guide stresses performance, reliability and safety, so asking questions and reading documents comes before any change to a machine.
Who owes you what?
The ISA/IEC 62443 series is built on shared responsibility among asset owners, automation product suppliers, integrators and service suppliers. Use that split in your request letters. The product supplier knows what is inside the product. The integrator knows how it was combined on your line. You, as owner, hold the final inventory.
Write it into purchasing terms: a component list in a standard format at delivery, an updated one when firmware changes, and a named contact for security advisories.
What format should you ask for?
The two common SBOM formats are SPDX and CycloneDX. Ask for either, in a machine readable file, not a PDF table. CISA has been revising its minimum elements for SBOMs; the page I read marked the 2025 draft as open for comment and pointed to a 2026 version, so check the current text before you write field requirements into a contract.
Ask for firmware too. Firmware images often bundle an operating system, a web server for the panel and a handful of libraries. A vendor can list them even when the source code is closed.
What will go wrong?
The vendor has nothing. Some suppliers have never produced one. Ask for a timeline, and in the meantime ask for a list of third party components and the version of any embedded operating system.
The list is out of date. An SBOM from the day of manufacture says little after years of field updates. Ask how updates revise it.
Names do not match. Industrial components are sometimes named in ways that do not match public vulnerability databases. Expect manual matching work.
Presence is not exposure. A flawed component may sit in a part of the device that is not reachable from any network. Reachability and network placement decide real risk, which is why the access map from your first week matters.
How do you use what you receive?
Load every file into one inventory keyed by machine, line and plant. When a new advisory arrives, search that inventory instead of the inbox. Then rank by exposure: machines reachable from vendor remote access or the office network come before sealed cells.
A scanner that reads SBOMs can do the matching for the open source components. Safeguard's reachability analysis helps separate flaws that can be triggered from those that sit in unused code, for software you can analyze. For closed firmware, your strongest evidence is the vendor's own advisory process.
What to do
- List installed machines by vendor, model and firmware version.
- Send each vendor a written request for a component list and an advisory contact.
- Add SBOM delivery and update clauses to new purchase orders.
- Store every file in one inventory, with the date received.
- Rank machines by network exposure, then by flaw severity.
- Review the inventory whenever a major advisory lands, and note how long the answer took.
Quick check
Is an SBOM the same as a patch list?
No. It lists what is inside a product. A patch list says what to update. You need the first to find out whether you need the second.
What if the vendor refuses?
Record the refusal, ask for a component list in any format, and treat that machine as higher risk until you can reduce its exposure through network controls.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, fetched 18 October 2026.
- ISA/IEC 62443 series overview, fetched 18 October 2026.
- CISA, SBOM minimum elements, fetched 18 October 2026.
Last reviewed: 18 October 2026.
