• Indian Computer Emergency Response Team ( CertIn )
• Its pivotal organization formed by Ministry of Electronics and Information Technology 2004.
• Effective response to Cyber Incidents.

Role

• Safeguard systems and network from:

1. Cyber threats
2. Including Malware , Hacking and Data Breaches

• Its key role is to monitor and analyse cyber threats and Vulnerabilities.
• Source : Government Agencies , Private Sector Organization , International Partners which helps to identify emerging threats and trends.
• The advisories and alerts are circulated amoung stakeholders.
• It also conducts awareness program.
• Fostering a culture of Cyber Security AWARENESS.
• Aims to empower individuals and Oraganization to protect themselves against Cyber threats.
• The Role of CERT-In in ensuring cyber security is becoming more critical day-by-day.

Technical Guidelines on | SBOM | QBOM & CBOM | AIBOM | HBOM |

SBOM

• Software Bill of Materials
• A complete inventory of software components used in an application.
• Includes:

1. Libraries (open source + proprietary)
2. Versions
3. Licenses
4. Dependencies
5. Vulnerability mapping

AIBOM

• AI Bill of Materials.
• It includes servers, sensors, and GPUs. Also AI models , frameworks ,and development tools.
• Inventory of all AI‑model components, mandatory for AI systems.

Model name, type, version
Training dataset sources
Algorithms & architecture (LLM, CNN, etc.)
Open‑source AI components
External integrations
Governance approvals (MANDATORY per CERT‑In)

Benefits of AIBOM

Minimum Elements Required

Recommendation & Best Practices

• The format for generating AIBOM for AI solutions should adhere to established standards, such as Software Package Data eXchange (SPDX) or CycloneDX, ensuring compatibility and uniformity across the industry.

• The AI developer/integrator organization that supplies AI solutions to government and public sector organizations should develop a Vulnerability Exploitability eXchange (VEX) for AI models after a vulnerability or security issue is discovered.

HBOM

• Hardware Bill of Materials
• Inventory of hardware components supporting the application.

Servers
Network devices
Storage systems
Firmware versions
End‑of‑life/End‑of‑support status

CBOM

• Configuration Bill of Materials
• Inventory of configuration elements that define how the system is deployed.

Config files
Environment variables
Parameter sets
Network config (ports, protocols, IPs)
Deployment descriptors

QBOM

• Cloud Bill of Materials
• QBOM is referenced alongside CBOM in the CERT‑In document.
• A structured inventory of all cloud components used by an application.

Cloud services (AWS, Azure, GCP, etc.)
Compute resources (VMs, containers)
Storage buckets / databases
Identity & access configurations
External APIs hosted on cloud

Notes

• Pivotal --> extremely important or central because everything else depends on it.
• foster --> to help or encourage the development of something (especially feelings or ideas).