You can ask for one, and standards exist to describe it. A software bill of materials lists software components, and a hardware bill of materials in CycloneDX covers hardware and associated firmware. Request both from your turbine supplier in a machine readable format, expect gaps on older equipment, and store what you receive.
What types of bill of materials exist?
CISA describes an SBOM as a nested inventory, a list of ingredients that make up software components, and calls it a key building block in software supply chain risk management. Its page focuses on software and does not address hardware or operational technology.
For machines, CycloneDX has a hardware bill of materials type. The project describes HBOM as a way to inventory hardware components for IoT, ICS and other embedded and connected devices, capturing inventories of physical components and associated firmware. CycloneDX also lists types for operations, manufacturing, vulnerability disclosure and vulnerability exploitability exchange, known as VEX.
VEX matters for the shop floor. CISA describes it as an attestation, a form of security advisory, about whether a product is affected by a known vulnerability. It answers the question your technician actually has: is this flaw relevant to my machine?
What should you ask a turbine supplier for?
Make the request specific so it can be met.
- An SBOM for each software image deployed on controllers, gateways and monitoring units, with component names and versions.
- An HBOM or equivalent listing controllers and communication modules, with the firmware version each runs.
- VEX statements for flaws that are publicly known in listed components.
- A vulnerability contact and a stated timeline for advisories.
- A format, such as CycloneDX or SPDX, so your tools can read it.
NTIA published a report on minimum elements for an SBOM, which is a useful baseline to cite when you ask. We did not retrieve the element list for this post, so check the report itself before writing it into a contract.
What can you expect?
Be realistic. Newer products and suppliers selling into the EU have an incentive to provide this. The Cyber Resilience Act, which covers products with digital elements, requires manufacturers to handle vulnerabilities across the lifecycle, to report actively exploited ones from 11 September 2026, and applies its main obligations from 11 December 2027. The Commission's page does not say whether it requires an SBOM, so do not assume it does.
Older equipment may have no list at all. In that case, build your own inventory from what you can see: device model, firmware version, installed tools and remote access software. A partial list you maintain is worth more than a perfect list you do not have.
Standards help you frame the ask. ISA and IEC 62443 Part 4-1 sets secure product development lifecycle requirements for suppliers, and Part 4-2 sets technical security requirements for components. NIST SP 800-161 guides organizations in identifying, assessing and mitigating cybersecurity risks across the supply chain, because limited visibility into how acquired technology is built is itself a risk.
How do you store and use the lists?
Treat them as living records. Store each file with the device it describes, the date received and the version. When a new flaw is announced, search your records for the component, then ask the supplier for a VEX statement.
Tools can do the matching. Safeguard generates SBOMs for code and matches components to known vulnerabilities, and can ingest an SBOM file for review. It does not create an HBOM for a physical turbine from nothing. That information comes from your supplier or your inspection.
What to do
- Pick one turbine model and request SBOM, HBOM and VEX from the supplier.
- State the format you want, and attach the NTIA minimum elements report as a reference.
- Ask for a named contact for vulnerability advisories.
- Build a spreadsheet of device, firmware version and remote access method for models with no list.
- Store every received file with a date and version, and keep it with the maintenance record.
- When a flaw is published, search your inventory and request a VEX statement from the supplier.
- Add the request to new purchase and service contracts.
Quick check
Is an SBOM enough for a machine?
Not alone. An SBOM covers software. Add hardware and firmware information, for example an HBOM, and VEX statements about known flaws.
Does the EU Cyber Resilience Act require an SBOM?
The Commission page we fetched does not say. It covers vulnerability handling and reporting. Check the regulation text or take legal advice.
Sources
- CISA: Software Bill of Materials, fetched 18 October 2026
- CycloneDX: HBOM capability, fetched 18 October 2026
- CycloneDX: capabilities, fetched 18 October 2026
- NTIA: Minimum Elements for a Software Bill of Materials, fetched 18 October 2026
- ISA: ISA/IEC 62443 series of standards, fetched 18 October 2026
- NIST SP 800-161 Rev. 1, fetched 18 October 2026
- European Commission: Cyber Resilience Act, fetched 18 October 2026
Last reviewed: 18 October 2026.
