AIBOM Workshop at SBOM-a-Rama (Fall 2024)

Building on the success of our initial AIBOM workshop at RSAC 2024, we are continued our efforts at the CISA SBOM-a-Rama this fall. Since May 2024, we have made significant progress, including the development and formalization of key AIBOM use cases. This workshop, in September 2024, provides a collaborative platform to brainstorm and define the next steps in advancing AIBOM, ensuring we remain at the forefront of AI software supply chain security. Your insights and contributions will be invaluable as we work together to shape the future of AIBOM.

Reference: review the AIBOM TT Update presentation from CISA's SBOM-a-Rama Day 1.

Agenda and Slides References

Objective: strategic discussion about the future of AIBOM

1. Introduction by AIBOM TT Leads, overall slides for the AIBOM Workshop on Sept.12
2. Overview of AIBOM Use Cases by Amy Villaseñor
   • Content: progress to date, use case framework, next steps
3. Presentation Unlocking the Insights AIBOM Research at SAP by Helen Oakley
   • Contnet: AIBOM fields mapping to scenarios (Model Card, AI assessments - licnese, legal, ethics), key findings and minimum AIBOM fields, AIBOM lifecycle strategy and interoperability.
4. Workshop Discussion:
   • Slides: AIBOM Workshop (Sept-12-2024)
   • Google Doc notes: AIBOM workshop notes

Summary

The primary consensus from the community was that the next steps after creating the AIBOM Use Cases should be:

• Developing the AIBOM Minimum Viable Product (MVP): defining the essential fields required for AIBOM, including establishing a feedback loop with SPDX and CycloneDX (CDX)
• Conducting AIBOM Field Mapping for the Highest Priority Use Case - Compliance: using an example scenario based on SB 1047 to map out the necessary fields for compliance purposes

For more details, please go to the Google Doc notes: AIBOM workshop notes.

Recording will be availalbe shortly on this channel: https://www.youtube.com/@SoftwareSupplyChainSecurity

Next Steps

• Continue with AIBOM Use Cases documentation as per on-going efforts: https://github.com/aibom-squad/AIBOM-Tiger-Team
  • AIBOM TT WG meeting minutes: Google doc
• Invite guest speakers to some of the AIBOM TT WG bi-weekly meetings to share insights on regulatory applicability to AIBOM (e.g., SB 1047)
• Start of the AIBOM fields mapping - TBD.

Contact

For more information, please reach out to:

• Helen Oakley
• Dmitry Raidman
• Amy Villaseñor

Thanks to Lockheed Martin for sponsoring the meeting space in Denver for AIBOM workshop!

Registration was managed via Luma here.