THE LINUX FOUNDATION PROJECTS
Announcements | SBOM Working Group

By | August 11, 2026

Open Mainframe Project Launches SBOM Working Group for z/OS Applications

 

SBOMs have become a baseline expectation for software supply chain security. Most existing standards were built with open source and cloud native stacks in mind. Mainframe applications work differently. Build and deploy processes are often incremental, source often spans multiple decades and multiple languages, and existing SBOM specifications don’t fully account for that reality. 

Open Mainframe Project’s newest Working Group closes that gap. The new Software Bills of Materials (SBOM) Working Group will adapt industry standard SBOM formats to fit traditional z/OS environments, starting with COBOL, PL/I, HLASM, and mixed language applications.

Goals

The working group has established four primary goals to advance SBOM standards for z/OS applications:

  • Evaluate existing industry SBOM standards, specifications, and formats – including SPDX and CycloneDX – to identify current capabilities and gaps for mainframe environments. 
  • Collaborate with the SPDX community, another Linux Foundation project, as well as the CycloneDX community, to define and standardize attributes, metadata, and profiles specific to z/OS applications. This work will help establish a minimum set of required fields aligned with published industry guidance while ensuring compatibility with widely adopted SBOM standards. 
  • Identify and document SBOM requirements that capture the complete software lifecycle for z/OS applications including source, build, deployment, and runtime considerations—with support for incremental build and deployment workflows commonly used in enterprise mainframe development, while remaining extensible to full application builds and commercial packaged software. 
  • Validate the proposed standards and implementation guidance through real-world testing and feedback from at least 10 mainframe enterprises, ensuring the resulting recommendations are practical, interoperable, and broadly applicable across the industry

The group plans to publish a set of GitHub pages covering an introduction to SBOMs for z/OS applications, guidelines for generating SBOMs from build, deploy, and runtime, and the attributes identified as necessary for z/OS applications. Alongside that documentation, the group will publish common packages for validating generated SBOMs.

Get Involved

The working group meets [meeting day, time, and frequency — TO CONFIRM]. Meeting details are listed on the Open Mainframe Project public calendar. Join by [Zoom/conference call link — TO CONFIRM] or join the Open Mainframe Project Slack

Meeting notes, recordings, and presentations from working group meetings are available on GitHub.

As software supply chain security requirements continue to evolve, it’s important that mainframe applications are represented by the same open standards used across the rest of the industry. If you work with SBOMs, mainframe development, build pipelines, or software supply chain security, now is the time to get involved. Your expertise can help ensure these standards reflect the realities of enterprise z/OS environments and benefit the broader ecosystem.

Keep up to date with Open Mainframe Project:

Share