SBOM Compliance for SEBI & CERT-In: How Mend.io Automates Software Supply Chain Governance

On 20 August 2024, SEBI released its Cybersecurity and Cyber Resilience Framework (CSCRF) - and with it, a requirement that SEBI-regulated entities maintain visibility into the software components used in their core and critical systems. For organisations running applications built on open-source software (which today means virtually every organisation), this means one thing: Software Bill of Materials (SBOM).

This guide explains exactly what SEBI and CERT-In require regarding software supply chain transparency, why manual SBOM creation is impossible at scale, and how Mend.io automates the entire process.

What is a Software Bill of Materials (SBOM)?

An SBOM is a formal, machine-readable inventory of all software components in an application - including open-source libraries, their versions, their licences, and their known vulnerabilities. Think of it as a nutrition label for your software: just as food manufacturers must disclose every ingredient, software providers must now disclose every component.

SEBI CSCRF Requirements - What You Need to Know

SEBI's CSCRF framework released in 2024 places regulated entities (REs) under obligations that directly require SBOM capabilities:

• Software Supply Chain Risk Management: REs must obtain a Software Bill of Materials for their core and critical systems, giving visibility into third-party software components used in them
• Vulnerability Disclosure and Management: REs must track and remediate known vulnerabilities (CVEs) in all software components - not just internally developed code
• Incident Response Readiness: In the event of a supply chain incident (like Log4Shell or XZ Utils), REs must report the incident to CERT-In and SEBI within 6 hours of noticing it or being notified of it
• Third-Party Risk Management: Software from vendors must be assessed for supply chain risks, requiring component-level visibility

CERT-In Directions: The Compliance Timeline

CERT-In's Directions of 28 April 2022, issued under section 70B of the Information Technology Act, require service providers, intermediaries, data centres, body corporates and government organisations to mandatorily report specified categories of cyber incidents to CERT-In within 6 hours of noticing them or being notified of them, and to retain ICT system logs for a rolling 180-day period. Separately, CERT-In's Technical Guidelines on SBOM recommend that government, public sector, essential services and software export/services organisations adopt SBOM as standard practice. Meeting the 6-hour reporting window while also maintaining an SBOM is difficult to do manually - automated, continuously updated SBOMs help organisations respond in time.

How Mend.io Automates SBOM Generation and Management

Mend.io (formerly WhiteSource) integrates directly into your build system and CI/CD pipeline to automatically discover and track every open-source component in your applications. No manual inventory work. No spreadsheets. No gaps.

Real-Time CVE Monitoring and Auto-Fix Pull Requests

An SBOM is only valuable if it's current. Mend.io continuously monitors all components in your SBOM against the latest CVE databases - including the NVD, security advisories and open source project issue trackers. When a new vulnerability is disclosed, every affected application in your portfolio is flagged instantly.

More importantly, Mend.io automatically generates pull requests to upgrade vulnerable dependencies to safe versions.

Licence Compliance: The Hidden Risk in Open Source

SBOM compliance isn't just about security vulnerabilities. Open-source licences carry legal obligations. GPL licences can require you to release your proprietary source code. AGPL can trigger copyleft obligations for SaaS applications. Mend.io's licence engine identifies hundreds of licence types across all components and enforces your organisation's licence policy automatically - preventing legal exposure before it becomes a litigation risk.

Building Your SEBI CSCRF Evidence Package with Mend.io

When SEBI auditors come calling, you need evidence - not promises. Mend.io generates on-demand compliance reports that demonstrate your software supply chain governance posture, including SBOM inventories exportable in SPDX or CycloneDX format and licence compliance status across all applications.

Mend.io's compliance reports are generated from evidence that is collected and organised automatically and continuously, rather than assembled manually at audit time.

The Log4Shell vulnerability showed how a single open-source component, used broadly across consumer and enterprise applications, can expose many organisations to the same flaw at once. SEBI and CERT-In have drawn a related conclusion: regulated entities must know the components used in their core and critical systems, monitor those components continuously, and report qualifying incidents within 6 hours. Mend.io makes that easier to do.

Sources

Primary documents this article is based on. Product statements and regulatory clauses above were checked against these pages.

• SEBI CSCRF circular (20 Aug 2024)
• CERT-In Directions under IT Act s.70B(6) (28 Apr 2022)
• CERT-In Technical Guidelines on SBOM, QBOM & CBOM, AIBOM, HBOM v2.0 (9 Jul 2025)
• SPDX project - About
• CycloneDX homepage
• Mend.io SCA product page
• Mend.io vulnerability database
• Mend.io docs - Mend Remediate and Renovate
• Mend.io docs - third-party commercial/proprietary licence support
• Mend.io docs - WhiteSource rebrand to Mend FAQ
• NVD (NIST) - CVE detail records
• CISA - Apache Log4j Vulnerability Guidance