---
title: "Getting Real with the Supply Chain: From SBOM Data to Action"
date: 2026-03-17
categories:
  # Language
  - english
  # - deutsch
  - presentation
  # - podcast
  # - article
tags:
  - OSPO
  - SupplyChain
  - DeutscheBahn
headerimage:
  src: max-cornelius-stage.jpg
  alt: Cornelius Schumacher and Max Mehl giving the presentation at FOSS Backstage 2026. It's a total view of the auditorium from the back, with the two speakers on stage and the final slide in the background.
# summary: Visible on the listing page, but not on the article page
video: https://www.youtube.com/watch?v=M8wYRRCWaQU
slides: https://up.mehl.mx/slides/2026-03-17-foss-backstage-supply-chain.pdf
event:
  name: FOSS Backstage 2026
  href: https://26.foss-backstage.de/session/getting-real-with-the-supply-chain-from-sbom-data-to-action/
---

At DB, we handle 100,000+ SBOMs per day. For our small, virtual Open Source Program Office (OSPO), the challenge is not to get lost in the data, but to cut through the jungle and identify real risks. Together with my OSPO colleague Cornelius Schumacher, I presented this challenge at the FOSS Backstage conference in Berlin. We explained how we gather data, generate insights, and take action.

This talk was partly inspired by my earlier FOSDEM talks ([here](/blog/2026-01-fosdem-supply-chain-strategy) and [there](/blog/2026-02-fosdem-sbom-collection)), where I focused on DB's SBOM program and its tools. In this presentation, however, we highlighted what can be learned from it for professional Open Source management.

One topic stood out throughout the presentation: the need for an OSPO to balance between people, value, and risk. None of these should dominate, even though governance functions often tend to focus on risk. Instead, Cornelius and I advocated for a risk-based approach to managing Open Source.
