Compliance
SBOM, secure boot and signed updates
A software bill of materials is a list of what is inside the software, and it is becoming as ordinary a request as the hardware one.
Why it comes up
Why anyone is asking
A drone is a computer that flies. Customers who have been through a supply-chain incident now ask what is in the firmware, who can change it, and how a unit in the field knows an update is genuine. Those answers are architecture, so they are cheap at the start and expensive later.
What we do about it
- Produce an SBOM as part of the build, so it matches what shipped
- Design secure boot in, rather than adding a signature check at the end
- Sign firmware updates and hold the keys in hardware, so they cannot simply be read out
- Write down the update path, including how a unit recovers from a bad one
This describes how we work. It is not legal advice, and what a rule requires of you depends on your customer and your contract.
What this covers in the package
- SBOM
- Secure boot and signed firmware update process
- Cybersecurity architecture
The other subjects
What NDAA compliance means for a build
A drone is not compliant because a supplier says so. It is compliant because what is inside it, and who built it, can be shown.
Country of origin and the bill of materials
The claim that matters is not where a drone was assembled. It is where each part in it came from.
What an FCC certification plan covers
A commercial product that transmits generally has to be authorized before it can be marketed, and that is a hardware decision, not a late one.