HBOM for Indian enterprises

CERT-In names the HBOM in national guidance and lists its minimum elements. For enterprises, the question is how those elements fit alongside sector regulators and telecom rules.

The Indian context

Indian enterprises face HBOM-relevant expectations from several directions: CERT-In as the national CERT, sector regulators such as RBI and SEBI, and the Department of Telecommunications for network equipment. None of these creates a single “HBOM law”, but together they make hardware and firmware inventory a routine compliance input.

CERT-In Version 2.0

CERT-In’s Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, Version 2.0, dated 9 July 2025, extend its SBOM guidance to hardware ^[1]. The minimum HBOM elements are component name, version, supplier, licence, dependencies, hardware vulnerabilities, patch status, release date, EOL date, criticality, checksums or hashes and unique identifier ^[1]. Legal commentary highlights that the HBOM seeks “greater transparency in the sourcing and maintenance of hardware components” and extends to embedded software and firmware dependencies ^[2]. The guidelines are addressed to government, public sector, essential services and software export organisations; private enterprises that supply them, or that are designated as essential, should expect the fields to appear in contracts. See CERT-In HBOM requirements.

Sector regulators

RBI’s IT governance directions (effective 1 April 2024) require regulated entities to avoid outdated and unsupported hardware, to monitor end-of-support and AMC dates of IT hardware on an ongoing basis, and to keep a technology refresh plan ^[3]. SEBI’s Cybersecurity and Cyber Resilience Framework (August 2024) sets the cyber-resilience baseline for SEBI-regulated entities ^[4]. Neither prescribes an HBOM format, but both need the lifecycle and inventory data an HBOM holds. Banks and financial institutions should also read HBOM for banks.

Telecom equipment

DoT’s licence amendment of 10 March 2021, effective 15 June 2021, requires licensees to connect only trusted products, with the National Cyber Security Coordinator as the designated authority; upgrades using non-designated equipment need permission ^[5]. DoT’s letters to licensees describe the Trusted Telecom Portal becoming operational on 15 June 2021 ^[6]. The Telecommunications (Telecom Cyber Security) Rules, 2024, notified on 21 November 2024, add obligations including reporting security incidents within six hours and registering IMEI numbers before first sale for relevant equipment ^[7]. Enterprises that are not licensees are not directly bound, but operators may ask them for product information when connecting customer equipment.

What this means in practice

Firmware and imported equipment

Much enterprise hardware in India is imported, and its firmware is maintained by overseas vendors. Recording firmware provider and version per device, and integrating vendor bulletins with CERT-In advisories, lets security teams act on hardware advisories without waiting for a vendor to identify affected customers.

A starting plan

1. Map which of these drivers apply to each business unit.
2. Adopt the CERT-In HBOM elements as the baseline field policy, adding sector-specific dates such as AMC expiry.
3. Inventory critical infrastructure first, with firmware versions and EOL dates.
4. Add HBOM clauses to procurement templates.
5. Integrate CERT-In advisories and vendor bulletins into vulnerability management for hardware and firmware.

How IntelliXBOM helps

IntelliXBOM validates HBOMs in CycloneDX and SPDX against the CERT-In elements, tracks EOL and patch status, and correlates hardware and firmware with vulnerabilities and business services. It maps the inventory to frameworks such as CERT-In’s guidelines and RBI’s directions as timestamped evidence, deployable on-premise or air-gapped.

This article summarises public guidance and is not legal advice.