Identify use cases for SBOM for mainframe applications

[suman-gopinath]

1. Review existing usecases for SBOMs
2. Applicability of each to mainframe applications
3. Identify gaps or non-applicable areas, if any.

[emretunar-bc]

Initial Draft - Applicable Use Cases:

1. For Open Source Software used in Mainframe Applications:
   a. Pre-Deployment CVE vulnerabilities
   b. Post-Deployment CVE vulnerabilities
   c. Licensing Risks
   d. Component usage across organization
   e. Incident response
2. For First Party Components in Mainframe Applications:
   a. Component usage across organization (for common modules used in multiple applications)
   b. Incident response (same as above - for commonly used modules in multiple applcations)
   c. Differences in components between builds/versions (and also integrity verification between different environments like test, prod)
3. Third party proprietary components in MF Applications
   (Emre to identify what use cases apply)

[PKremling]

A few additional use cases we thought of:

• Are licenses for Db2/CICS/etc. already covered? How? How to check?
• Versions of middleware/OS/Compiler: Are these still supported by IBM/Vendors?
• Common issue in production is that certificates expired and were not renewed. Maybe we should take care of that, too.

• Dependency of applications on user privileges (e.g. Db2 technical user whose password expired)