Streamlined compliance audits and SBOM sharing
Stay Compliant with Global Software Regulations
The Manifest Platform helps organizations meet the growing demands of national and international software security regulations. By providing centralized visibility, continuous monitoring, SBOM validation, and secure collaboration across your software supply chain, Manifest simplifies compliance and strengthens governance at scale.
The following sections break down what each major regulation requires and how it impacts your software security program.
Manifest supports requirements for:
CISA Minimum SBOM Elements
Summary:
Establishes a baseline for SBOM transparency, while emphasizing that richer data (such as licenses and hashes) enables stronger risk management. Minimum compliance alone is insufficient without validation, automation, and continuous monitoring.
How Manifest enables customers:
Automates high-quality SBOM generation and enrichment, validates third-party SBOMs, and integrates vulnerability and provenance checks to go beyond minimum requirements.
DoW RMF (NIST 800-53 Rev. 5)
Summary:
Framework for assessing and authorizing systems, emphasizing supply chain risk controls. NIST SP 800-53 does not directly address SBOMs, but new controls around logging, validation, and root cause analysis align with SBOM principles and support integrity of software components.
How Manifest enables customers:
Automates SBOM and AIBOM evidence collection and analysis, maps to 800-53 SR/SA controls, and supports continuous monitoring with exportable audit artifacts.
DoW SWFT
Summary:
Aims to accelerate software delivery while requiring deep supply chain visibility. SBOMs are foundational, enabling DoW to verify components, assess vulnerabilities, and trace provenance as part of risk-based authorization.
How Manifest enables customers:
Delivers continuous SBOM monitoring, third-party validation, and integration with vulnerability, provenance, and AI/ML risk workflows to support SWFT’s real-time risk determination model.
EU Cyber Resilience Act (CRA)
Summary:
EU-wide security-by-design rules for digital products, including vulnerability handling, incident reporting, and lifecycle updates. Demonstrate compliance with component-level security and update obligations.
How Manifest enables customers:
Generates and maintains SBOMs/AIBOMs, links components to vulnerabilities and provenance, automates continuous monitoring and notifications, and produces exportable evidence for CRA conformity.
EU NIS 2 Directive
Summary:
EU-wide cybersecurity obligations for essential and important entities, including supplier oversight, risk management, and incident reporting. Strengthen supply chain resilience and software visibility across critical infrastructure sectors.
How Manifest enables customers:
Delivers visibility, continuous vulnerability and provenance monitoring, and exportable evidence to support NIS 2 risk management and reporting.
Executive Orders 14028 & 14144
Summary:
Shifts federal software assurance away from static attestations toward outcome-based security. SBOMs remain foundational, enabling continuous visibility into components, dependencies, and vulnerabilities.
How Manifest enables customers:
Provides actionable SBOM data, verifiable secure development evidence, and continuous supply chain monitoring to support SSDF-aligned, data-driven risk reduction.
FDA Cybersecurity Guidance (2023 & 2025)
Summary:
Requires medical device makers to provide and maintain SBOMs for pre- and post-market security, including vulnerability management and transparency into end-of-life and end-of-service components that could lead to loss of service or patient safety risk.
How Manifest enables customers:
Generates and updates SBOMs/AIBOMs, tracks EOL/EOS components, links them to vulnerabilities and impact, and supports continuous monitoring and evidence for FDA submissions
NIST 800-218 (Secure Software Development Framework)
Summary:
Provides guidance for secure development practices, emphasizing traceability and integrity of third-party components throughout the lifecycle.
How Manifest enables customers:
Delivers SBOM/AIBOM generation and enrichment, automates component integrity checks, and supports continuous monitoring to meet SSDF supply chain expectations.
OMB M-22-18
Summary:
Mandates federal agencies to integrate software supply chain security controls, including the collection and verification of SBOMs across acquisitions.How
Manifest enables customers:
Automates SBOM ingestion from suppliers, verifies integrity against baseline policies, and provides dashboards for federal compliance and audit readiness.
UNECE R155 & ISO/SAE 21434
Summary:
Require automakers and suppliers to manage cybersecurity risk across the vehicle lifecycle and software supply chain, including supplier oversight, vulnerability management, and continuous monitoring.
How Manifest enables customers:
Delivers SBOM/AIBOM generations and enrichments for ECUs and apps, automates supplier evidence and vulnerability tracking, and supports CSMS and engineering process documentation for compliance.
OWASP SAMM
Summary:
A maturity model for building and improving software assurance programs, including third-party and supply chain risk workflows.
How Manifest enables customers:
Enhances SAMM maturity with SBOM/AIBOM enrichment, automated component risk checks, and continuous third-party monitoring.