Supplier SBOM Submission Guide on SK telecom Open Source

SBOM Submission Requirements

Mon, 01 Jan 0001 00:00:00 +0000

1. Standard Data Formats

SK Telecom supports both formats that have become established as global standards. Suppliers may choose and submit the format supported by the tool they use.

Format	Version	Recommended Use	File Format
CycloneDX	v1.3, v1.4, v1.5, v1.6	Application security, vulnerability management focus	JSON (recommended), XML
SPDX	v2.2, v2.3	License compliance focus	JSON, Tag-Value

Note: Both formats are recognized equally, but CycloneDX (JSON) format is recommended for internal system interoperability.

Pre-Submission SBOM Validation Checklist

Mon, 01 Jan 0001 00:00:00 +0000

Essential Checklist Items

An SBOM that does not pass the checklist below may be automatically rejected by the system.

1. File Integrity

Is the file extension .json or .xml? (Not an archive file)
Is the file size at least 1KB, and the content not empty?
Are there any JSON syntax errors? (Verification with jq or similar is recommended)

2. Required Data Fields

bomFormat: Is CycloneDX or SPDX specified?
Metadata: Are the name and version of the top-level component (the delivered project) accurate?
Components: Does the list of included libraries match the actual ones?

3. Dependency Completeness Check

Missing transitive dependencies are the most common reason for rejection. Be sure to verify the items below.

SBOM Submission Process

Mon, 01 Jan 0001 00:00:00 +0000

1. When to Submit

At initial delivery after concluding a software contract
When a major or minor version of the software is updated
When a regular submission schedule specified in the contract arrives

2. How to Submit

The SBOM file is submitted to SK Telecom’s business unit and security team representatives via email or a designated system.

Submission Method

Deliver the SBOM file to the business unit and security team representatives via email or a channel designated by the representative.
Email subject: [SBOM Submission] SupplierName_ProjectName_Version
Attachment: The generated SBOM file (password-protected archive files are not allowed)

Required information in the body: