Supplier SBOM Submission Guide

An SBOM generation and submission guide for partner companies that supply software to SK Telecom.

To strengthen the transparency and security of its software supply chain, SK Telecom asks suppliers to submit an SBOM (Software Bill of Materials) for all software components and dependencies they deliver. This guide explains how suppliers can generate and submit an SBOM in a format that meets SK Telecom’s security policy.

Scope of Application

All suppliers (including developers and resellers) that deliver the following types of software are subject to these guidelines.

Source code: Applications written in Java, Python, JavaScript, Go, C/C++, etc.
Container images: Docker images or OCI-compliant containers
Executables: Compiled binaries (.jar, .dll, .so) and libraries
Embedded systems: Firmware images, RootFS, device drivers

SBOM Submission Process

We ask suppliers to follow the procedure below, from the time of contract through final delivery.

flowchart TD
    A[Contract Review] --> B["Software Development/Build"]
    B --> C{Generate SBOM}
    C -->|Use SKT-provided tool| D[Use SKT SBOM Generator]
    C -->|Use your own tool| E["Use open source tools<br>(cdxgen, Syft, etc.)"]
    D --> F["Data Validation (PURL Check)"]
    E --> F
    F --> G["Submit SBOM (Email/Portal)"]
    G --> H[SKT Security Review]
    H -->|Approved| I[Delivery Complete]
    H -->|Rejected| J[Remediate and Resubmit]
    J --> F

Guide Structure

This section is organized as follows.

Submission Requirements: Defines the required formats (CycloneDX, SPDX) and data fields that SK Telecom requires.
SKT SBOM Generator: Explains how to use SK Telecom’s SBOM generation tool.
Using Open Source Tools: Explains how to generate an SBOM using general-purpose open source tools (cdxgen, Syft, etc.).
Validation Checklist: Provides a checklist of essential items to verify before submission.
Submission Process: Explains the naming conventions and submission channels for the generated SBOM file.

SK Telecom Supply Chain Security Policy: Background and principles of the mandatory SBOM submission policy
Global Regulatory Trends: Domestic and international regulatory landscape related to SBOM