Getting Real with the Supply Chain: From SBOM Data to Action #FOSSBack

This talk, presented by Max Mehl and Cornelius Schumacher, focuses on managing the complexities of software supply chains at Deutsche Bahn, which utilizes 500,000 Software Bill of Materials (SBOMs). The speakers discuss their strategy for transforming data into actionable tasks, emphasizing a risk-based framework that addresses compliance, governance, and sustainability. Key topics include managing regulatory obligations such as the CRA and NIS2, setting practical internal compliance rules, and fostering an open-source culture that encourages community participation. The session offers hands-on insights geared towards organizations looking to transform extensive SBOM data into meaningful decisions and responsible actions.