Where to add level of support and component's end-of-support date

[braggpeaks]

For medical products, FDA is requesting:

In addition to the minimum elements identified by NTIA, for each software component contained within the SBOM, manufacturers should include in the premarket submission:
The software level of support provided through monitoring and maintenance from the software component manufacturer (e.g., the software is actively maintained, no longer maintained, abandoned); and
The software component’s end-of-support date.

However, I did not find this in the CycloneDX v1.6 specification. Is there a common or suggested place to denote this information?

Thank you,
Daniel

[jkowalleck]

see also:

• Request: Add project sustainability fields to CycloneDX #400

[ppkarwasz]

See also:

• [FEATURE]: Add external reference type for support policy/lifecycle metadata #591

IMHO both the sustainability and lifecycle information should be handled via an externalReference in an SBOM file, because SBOMs are usually immutable, while this information changes in time.

There are currently CycloneDX working groups for both a Commons Lifecycle Enumeration (to check if the manufacturer didn't discontinue the product) and OSS Sustainability (to check if the OSS project is maintained).

[braggpeaks]

Thank you for the references, see also

• Add properties required by FDA certification cyclonedx-property-taxonomy#104

You are absolutely right, externalReference might also be a valid option if a component has a valid reference to link to. Components that are no longer available or no longer maintained might not or no longer have dedicated webpages.