What India’s latest software supply-chain initiatives mean for third-party risk management

Software supply chains are becoming increasingly complex. Enterprises depend on external applications, cloud platforms, software components, technology providers and other third parties, making visibility into what sits inside that ecosystem an increasingly important part of risk management.

On September 3, 2026, CERT-In conducted a workshop on technical guidelines for SBOM, QBOM, CBOM, AIBOM and HBOM for officials from government departments, PSUs and private-sector organizations. According to CERT-In, the objective was to establish a standardized approach to managing Bills of Materials to improve transparency, vulnerability management, supply-chain security, risk assessment, compliance and incident response.

Why this matters for enterprises

Bills of Materials are traditionally discussed in the context of software composition and product security. But for enterprises, the broader issue is visibility.

A technology supplier may depend on multiple software components, cloud services, open-source technologies and other providers. Those dependencies can introduce risks that are not immediately visible from the primary vendor relationship.

This creates a wider third-party risk question:

Do you understand what your vendors depend on — and can you identify when those dependencies create additional exposure?

CERT-In’s September activity reinforces the importance of supply-chain visibility as part of the overall risk picture. CERT-In’s 2026 security guidance also emphasizes extending security expectations to vendors and the broader supply chain, including tracking Bills of Materials and assessing software dependencies.

From vendor assessment to supply-chain visibility

Traditional vendor onboarding often relies on questionnaires, documentation and periodic assessments.

These remain important, but they provide only a snapshot.

A stronger approach connects:

Vendor → Technology Exposure → Dependencies → Risk Signals → Assessment → Monitoring → Action

The objective is not simply to collect more data. It is to understand how a supplier’s technology and dependencies affect the enterprise relationship.

For example, a change in a supplier’s security posture could warrant a reassessment. A significant vulnerability affecting a technology component could trigger additional review. A newly identified fourth-party dependency could change the overall exposure associated with a critical service.

Cyber risk is only one part of the picture

Software supply-chain security naturally brings cybersecurity into focus, but enterprise third-party risk extends beyond cyber.

Depending on the nature and criticality of the relationship, organizations may also need to consider:

• Sanctions and restricted-party exposure
• Adverse events and regulatory developments
• Financial viability
• Business continuity and resilience
• Compliance requirements
• Data protection
• Fourth-party and broader supply-chain dependencies
• Vendor performance and contractual obligations

Enlighta’s TPRM materials describe continuous monitoring across multiple risk dimensions, including cyber risk, sanctions, adverse events and fourth-party exposure.

Moving from point-in-time assessments to continuous TPRM

The risk associated with a supplier can change after onboarding.

That makes continuous monitoring important, particularly for vendors supporting critical services or handling sensitive information.

A continuous approach can connect the vendor lifecycle:

Screen Third-Parties → Onboard & Segmentation → Assess Risks → Monitor Risks Real-Time → Monitor Performance → Governance & Compliance → Offboard Third-Party

This allows organizations to move beyond a model where risk is reviewed only during onboarding or an annual assessment cycle.

How Enlighta helps

Enlighta brings third-party screening, vendor onboarding and segmentation, risk assessments and continuous monitoring into one connected TPRM process.

External risk intelligence can be incorporated alongside vendor information and assessment data, while fourth- and fifth-party relationships can be tracked as part of the broader supplier ecosystem. Enlighta also connects risk management with evidence, issues and remediation, contracts, SLAs, obligations, performance and governance.

The result is a connected process where a supply-chain risk signal can become a vendor-level assessment, an assigned action, remediation workflow or ongoing monitoring activity rather than remaining isolated in a separate security system.

What organizations should consider

As software and technology dependencies become more interconnected, third-party risk programs need visibility beyond the immediate supplier.

The practical question for organizations is no longer only:

“Is this vendor secure?”

It is also:

“What does this vendor depend on, how could that change our exposure, and how quickly can we respond?”

That is where software supply-chain security becomes part of continuous third-party risk management.

Source: CERT-In, Workshop on Technical Guidelines on Bill of Materials: SBOM, QBOM, CBOM, AIBOM and HBOM, September 3, 2026.

Explore Enlighta Continuous TPRM →