Labels, SBOMs, Vulnerability 

Reports, Transparency Reports Oh 

My... 

Katerina Megas – Program Manager, Cybersecurity for the Internet of Things 

Angela Smith -- Technical Lead – Cybersecurity Supply Chain Risk Management Program 

NIST

19 April 2023
Transparency is the watchword of the hour

“Every organization should demand transparency regarding the practices 

and controls adopted by technology providers and then demand adoption 

of such practices as basic criteria for acceptability before procurement or 

use,” 

-- Jen Easterly, DHS CISA Director, Remarks at Carnegies Mellon University

horizontal cybersecurity requirements for products with digital elements

Objectives (iii): “to enhance the transparency of security properties of 

products with digital elements”

-- EU CRA Proposal, 15 Sept 2022

Whether it’s transparency related to how products are tested or 

measured to enable customers to accurately compare and evaluate 

products against one another, or transparency between companies to 

share threat intelligence about emerging threats, transparency is good 

for cybersecurity.

Greater Transparency Leads to Better Cybersecurity

-- Tony Bradley, Techspective, 24 April 2019

Device security principles for manufacturers

“We encourage manufacturers to publish their own transparency report, which 

will formally document how their products meet (or don’t meet) each of the 

device security principles.”

-- UK NCSC, 29 June 2021

Intel released the results of a study examining how transparency, 

security innovation and ongoing security assurance impact 

purchase decisions. Key findings indicated a preference for 

technology providers that are transparent and proactive in helping 

organizations manage their cybersecurity risk.”

The Role of Transparency and Security Assurance in Driving 

Technology Decision-Making

-- Intel, 15 March 2021

[T]he United States and its foreign and private sector partners will ... ensure that 

the “rules of the road” for technology standards favor principles of 

transparency, openness, consensus, relevance, and coherence. (Section 4.1)

Mitigating this risk will require long-term, strategic collaboration between public 

and private sectors at home and abroad to rebalance global supply chains and 

make them more transparent, secure, resilient, and trustworthy. (Section 5.5)

-- US National Cybersecurity Strategy, March 2023 (Section 41)

“Embrace radical transparency and accountability”

“Organizations should expect transparency from their technology 

suppliers about their internal control posture as well as their roadmap 

towards adopting Secure-by-Design and Secure-by-Default practices.”

“Organizations should prioritize cloud providers that are transparent

about their security posture”

Shifting the Balance of Cybersecurity Risk:

Principles and Approaches for Security-by-Design and -Default

-- DHS CISA + 5-Eyes Agencies, 13 April 2023
A consistent framing to think about transparency can 

support better cybersecurity

• Structured approach to providing information and actions to support secure product 

usage 

• Enable informed choices by acquirers of connected products

• Develop a shared lexicon around transparency

• Encourage transparency to reduce information gaps, which can promote trust and help 

mitigate risks

• Envisioned as a tool for sharing information/expectations across the supply chain. E.g.

• Guiding communications tailored for different kinds of audiences 

• Supporting product developers communicating with customers, regulators, 

conformance assessment bodies, other third parties who need to understand the 

product 
1 - Determine the target audience of the information.

2 - Define the purpose for delivering the information to the audience.

3 - Identify the appropriate mode (method) of transparency based on 

the target audience and purpose for the information.

4 - Develop the message and its contents that will be delivered via the 

method of transparency.

5 - Deliver the message and assess the impact of the transparency.
A tool for the connected product ecosystem

• Enable communication between 

stakeholders from different 

perspectives across the product 

ecosystem such as:

• Producers

• Suppliers and Vendors

• Regulators and Conformance 

Assessment Bodies

• Customers of different 

organizational size

• From home customers to 

governments

Supplier

Procurement

Inventory Manufacturing / Logistics

Distribution

Customer
Example of communication needs along connected 

product ecosystem 

A Consistent Approach Applied to Information Exchanges Throughout The Supply Chain

HW Supplier

SW Supplier

Service 

Supplier

Developers Acquirers

Regulators

Conformity 

Assessors

• Enable communication between stakeholders from different 

perspectives across the product ecosystem such as:

• Producers

• Suppliers and Vendors

• Regulators and 

• Conformance Assessment Bodies
Considerations

• What kinds of additional guidance can help stakeholders provide transparency in 

effective and consistent ways?

• Which existing standards, resources, and/or best-practices can help and/or inform 

this effort?

• Areas of interest:

• Taxonomy of target audiences

• Modes/methods of transparency (e.g., SBOM, labels, technical vs. nontechnical methods)

• How to assess impact
Next Steps

Release

Discussion 

Essay

Socialize 

the 

Approach

Draft Connected 

Product 

Transparency 

Framework

Further 

socialization 

working 

towards 

finalization

• Additional meetings and 

workshops

• Additional drafts developed 

and released as needed by 

the community.

8

• Meetings, 

workshops and 

other engagements 

with the community

• Build out these ideas and 

highlight key points for 

community input and buy-in