Getting Real with the Supply Chain: From SBOM Data to Action

At DB, we handle 100,000+ SBOMs per day. For our small, virtual Open Source Program Office (OSPO), the challenge is not to get lost in the data, but to cut through the jungle and identify real risks. Together with my OSPO colleague Cornelius Schumacher, I presented this challenge at the FOSS Backstage conference in Berlin. We explained how we gather data, generate insights, and take action.

This talk was partly inspired by my earlier FOSDEM talks (here and there), where I focused on DB’s SBOM program and its tools. In this presentation, however, we highlighted what can be learned from it for professional Open Source management.

One topic stood out throughout the presentation: the need for an OSPO to balance between people, value, and risk. None of these should dominate, even though governance functions often tend to focus on risk. Instead, Cornelius and I advocated for a risk-based approach to managing Open Source.