SBOM-preferred ala STIX-preferred as part of PACE

[sparrell]

OASIS CTI has a "STIX Preferred" self-certification program. Should PACE have a "SBOM Preferred" self certification program?

See https://youtu.be/hmp1NPswNH8 for a 1-minute video prepared for CISA SBOM-arama in Dec-2021. It wasn't shown due to lack of time to get to this topic.

[dlemire60]

Realistically, shouldn't this be up to the organizations that define SBOM standards? Why should an OASIS open (sub) project be attacking self-certification for someone else's standard(s)?

[slarchacki22]

03/14/2022 - decision made to defer