Microsoft Tightens Windows Driver Signing, Requires SBOM and VEX from March 2027
Microsoft is tightening its Windows driver signing requirements starting March 1, 2027. New regulations will mandate that driver developers provide Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) documents.
Microsoft has announced stricter signing requirements for Windows drivers, set to take effect on March 1, 2027. Under the updated Windows Hardware Compatibility Program (WHCP), developers submitting drivers for Windows 11 versions 25H2, 26H1, and Windows Server 2025 and later will be required to include a Software Bill of Materials (SBOM) and a Vulnerability Exploitability eXchange (VEX) statement.
This policy change is part of Microsoft's ongoing efforts to enhance the security and integrity of the Windows driver ecosystem. It also aims to align with evolving cybersecurity regulations, such as the European Union's Cyber Resilience Act (CRA), which emphasizes transparency and security throughout the software supply chain.
Drivers submitted without a valid SBOM or VEX, or those with unverified documents, will not receive WHCP signing. This applies to drivers certified through the Hardware Lab Kit (HLK) and those signed via Attestation. Existing submissions and drivers for Windows versions prior to Windows 11 25H2 and Windows Server 2025 are exempt from these new requirements.
Microsoft plans to release updated tools for generating and validating SBOM and VEX files with the Windows Driver Kit (WDK) in December 2026. Developers can also utilize third-party or industry-standard tools, provided the output adheres to the SPDX 3.0 format. Companies preparing to submit drivers after the March 2027 deadline are advised to familiarize themselves with these upcoming specifications and begin cataloging their software components.