Skip to main content

The Software Bill of Materials (SBOM)

A Software Bill of Materials (SBOM) is a formal and query-able record containing the details and relationships of various open-source, third-party, or commercial components used in building software.

Minimum SBOM Content Requirements​

As specified in The Minimum Elements For a Software Bill of Materials (SBOM) issued by the United States Department of Commerce, the SBOM should contain the following data elements at a minimum:

  • Component supplier
  • Component name and version
  • Other unique identifiers
  • Dependency relationship
  • SBOM author
  • Timestamp

SBOM Formats​

Standard SBOM formats are now available for communicating SBOM information to meet the government requirements.

  • SPDX (Software Package Data Exchange) is an open standard for communicating Software Bill of Materials (SBOM) information
  • CycloneDX is a lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts and supply chain component analysis
  • SWID (Software Identification Tagging) provides a transparent way for organizations to track the software installed on their managed devices