Compliance FrameworksEurope
BSI TR-03183-2
German Federal Office for Information Security SBOM requirements.
German Federal Office for Information Security SBOM requirements.
| Short name | BSI TR |
| Region | Europe |
| Country or scope | Germany |
| Sector | Government |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers BSI TR
- Scan requirements: 7, all decided by a scan.
- Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for BSI TR.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for BSI TR and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
DE-TR03183-FMT Machine-Readable SBOM Format | The SBOM must be provided in a standardised, machine-processable format such as SPDX or CycloneDX (BSI TR-03183-2, format requirements) | Scan |
DE-TR03183-DOC SBOM Document Metadata | Each SBOM must carry document-level data including a timestamp of creation, enabling versioning and audit of the SBOM itself (BSI TR-03183-2, SBOM-level required fields) | Scan |
DE-TR03183-CRE SBOM Creator Recorded | The creator of the SBOM (tool and/or organisation) must be recorded as a required document field (BSI TR-03183-2, SBOM creator field) | Scan |
DE-TR03183-VER Component Version Required | Every component entry must state the exact version of the component (BSI TR-03183-2, per-component required fields) | Scan |
DE-TR03183-HASH Component Integrity Hash | Components must carry a cryptographic hash of their executable/distributed form so integrity can be verified (BSI TR-03183-2, hash value field) | Scan |
DE-TR03183-LIC Component Licence Information | Licence information must be provided for components so legal obligations attached to the software can be assessed (BSI TR-03183-2, licence field) | Scan |
DE-TR03183-DEP Dependency Relationships | The SBOM must express the dependency relationships between components, not just a flat list (BSI TR-03183-2, dependency documentation) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
BSI-TR2-1 | Include Minimum SBOM Data Fields Per TR-03183-2 §3 |
BSI-TR2-2 | Provide Complete Dependency Relationships in SBOM §3.2 |
BSI-TR2-3 | Ensure SBOM Integrity with Cryptographic Signatures §3.3 |
BSI-TR2-4 | Achieve SBOM Completeness as Per §3.4 |
BSI-TR2-5 | Maintain Transparency of Third-Party Components §4 |
BSI-TR2-6 | Correlate SBOM with CVE/NVD and BSI Advisories §5 |
BSI-TR2-7 | Implement SBOM Lifecycle Management §6 |
BSI-TR2-8 | Produce SBOM in CycloneDX or SPDX Format |
BSI-TR2-9 | Provide SBOM to BSI on Request |
BSI-TR2-10 | Define SBOM Roles and Responsibilities |
Policy templates
Written for BSI TR:
- BSI TR-03183-2 SBOM Compliance Policy
- BSI TR-03183-2 Third-Party Component Transparency Policy
And 22 from the standard set, adapted to BSI TR.