Japan METI SBOM Guidelines

Software component transparency and vulnerability management requirements.


Short name	METI
Region	Asia-Pacific
Country or scope	Japan
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers METI

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for METI.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for METI and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`JP-METI-NAMEVER` Component Name and Version	SBOM entries must record each component's name together with its version, per the NTIA-aligned minimum elements adopted by the guide (METI SBOM Guide, minimum element data fields)	Scan
`JP-METI-SUP` Supplier Name	Each component must name its supplier so responsibility in the supply chain can be traced (METI SBOM Guide, supplier name minimum element)	Scan
`JP-METI-UID` Unique Identifiers	Components should carry other unique identifiers such as package URLs to enable automated lookup (METI SBOM Guide, unique identifier minimum element)	Scan
`JP-METI-DEP` Dependency Relationships	The SBOM must express the dependency relationships between components (METI SBOM Guide, dependency relationship minimum element)	Scan
`JP-METI-META` SBOM Author and Timestamp	The SBOM must record its author and the timestamp of its creation (METI SBOM Guide, author and timestamp minimum elements)	Scan
`JP-METI-TOOL` Creating Tool Provenance	The tool or organization producing the SBOM should be recorded to support trust in the document (METI SBOM Guide, SBOM creation process guidance)	Scan
`JP-METI-VULN` Vulnerability Management Use	SBOMs are to be used for vulnerability management, which requires components identifiable against vulnerability databases (METI SBOM Guide, vulnerability management use case)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`METI-SBOM-VIS-1`	Maintain Complete Software Component Inventory
`METI-SBOM-VIS-2`	Use a Machine-Readable SBOM Format
`METI-SBOM-VULN-1`	Monitor Components for Known Vulnerabilities
`METI-SBOM-VULN-2`	Communicate Vulnerabilities to Downstream Customers
`METI-SBOM-LIC-1`	Track and Comply with Open Source Licenses
`METI-SBOM-LIC-2`	Identify Copyleft Obligations in the Supply Chain
`METI-SBOM-SHARE-1`	Provide SBOMs to Customers on Request
`METI-SBOM-SHARE-2`	Receive and Ingest Supplier SBOMs
`METI-SBOM-PROC-1`	Integrate SBOM Generation into the Build Pipeline
`METI-SBOM-PROC-2`	Maintain SBOM Accuracy Across the Product Lifecycle
`METI-SBOM-RISK-1`	Assess Supply Chain Risk Using SBOM Data

Policy templates

Written for METI:

SBOM Lifecycle Management Policy
Open Source License Compliance Policy

And 22 from the standard set, adapted to METI.