Software Supply Chain Strategy at Deutsche Bahn

At FOSDEM 2026, I presented Deutsche Bahn&rsquo;s software supply chain strategy in the context of the EU Cyber Resilience Act (CRA), but made clear from the start that CRA was the context, not the trigger. We didn&rsquo;t adopt SBOMs because of regulation – regulation validated the direction we were already taking based on operational needs. The presentation positioned our work at the…