Abstract:
Microsoft announced that it will further raise the driver certification threshold for the Windows Hardware Compatibility Program (WHCP). Starting in March 2027, eligible Windows driver submissions must provide both a Software Bill of Materials (SBOM) and a Vulnerability Exploitability Description (VEX) file.
Microsoft announced in May this year that it would improve the quality of drivers in Windows systems through the "Drive Quality Initiative" (DQI). An important part of this initiative is the Windows Hardware Compatibility Program, which requires hardware partners to obtain Microsoft signatures for drivers. Starting in 2027, Microsoft will implement more stringent WHCP certification requirements for driver submission.
Microsoft stated that starting from March 2027, all drivers submitted through WHCP for certification must be accompanied by valid SBOM and VEX files. The new requirements apply to drivers developed for Windows 11 version 25H2, version 26H1, Windows Server 2025 and later versions. If a vendor fails to submit either of these documents, or if the document fails verification, its driver will not be able to obtain a signature.
Microsoft emphasizes that drivers developed for earlier versions of Windows, as well as drivers submitted before March 2027, do not need to provide SBOM and VEX files. In addition, both drivers certified through the Windows Hardware Lab Kit (HLK) and drivers submitted through certified signatures will be affected by this requirement.
This change mainly stems from the EU's Cyber Resilience Act (CRA), so the relevant requirements must be adhered to. However, Microsoft also acknowledged that this change will have a greater impact on partners and said it will do its best to provide support.
Microsoft plans to release a new version of the Windows Driver Kit (WDK) in December 2026, which will include the tools required to generate SBOM and VEX files. Related documentation is also expected to be released during the same period. Vendors can also use third-party tools to generate these files, but Microsoft requires that the final output strictly conform to the SPDX 3.0 format.
Microsoft has also released a lot of other technical guidance, but the most important thing at the moment is that driver vendors should familiarize themselves with the new version of WDK as early as possible and ensure that corresponding SBOM and VEX files are provided each time they submit a driver, instead of merging multiple driver information into one file and submitting it uniformly.
Comments