The Complete SBOM Guide: Formats, Regulations, and a Rollout Path

An SBOM — Software Bill of Materials — is a software product's ingredient list: which components it contains, in which versions, from where, under which licenses. The night Log4Shell (CVE-2021-44228) broke, organizations with SBOMs answered "where do we use log4j?" with a query; organizations without spent two weeks answering it with people. That is the value proposition in one sentence.

Choosing among the three standard formats

• SPDX — Linux Foundation-led, an international standard as ISO/IEC 5962, with the richest license and compliance semantics; the de facto choice for open-source compliance work.
• CycloneDX — from OWASP, an Ecma international standard since 2024, security-oriented by design with native VEX support, and the most broadly integrated in DevSecOps toolchains.
• SWID — ISO/IEC 19770-2 software identification tags, mainly for asset management; rarely the first choice for new programs.

Practical advice: your tooling must export both SPDX and CycloneDX — different customers and regulations name different formats, and the format war is not worth picking a side in. Content-wise, cover at least NTIA's seven minimum elements: supplier, component name, version, unique identifier, dependency relationships, SBOM author and timestamp.

Regulators everywhere are asking for it

United States: Executive Order 14028 (2021) put SBOMs into federal software procurement; since 2023 the FDA refuses premarket submissions for connected medical devices without one. European Union: the CRA makes a machine-readable SBOM a statutory duty, fully applicable by the end of 2027 — see our CRA timeline. China: the People's Bank of China and four other authorities require financial institutions to know their open-source usage (2021), CAICT-led SBOM standards and pilots keep advancing, and SBOM clauses are now routine in automotive and medical procurement contracts.

A four-step rollout path

Step 1: Generate. Produce SBOMs automatically from code and artifacts with an SCA tool. The pivotal decision is detection depth — manifest-level or snippet-level determines whether your SBOM records declared composition or real composition; see our comparison. For source-less third-party deliverables and firmware, binary composition analysis fills the gap.

Step 2: Enrich. A bare inventory is of limited value. Link components to vulnerability intelligence (CVE/CNVD/CNNVD/EUVD) and license obligations, and use VEX to mark what is present but not exploitable — that is what turns a document into a decision input.

Step 3: Deliver. Export in the format each customer or regulation names, sign it, and archive an SBOM snapshot per release.

Step 4: Operate. An SBOM is a living document: when a new vulnerability drops, answering "are we affected?" should be a minutes-level query, not a task force. This step is what separates platforms like CleanSource SCA from one-off generation scripts.

How to judge SBOM quality

Same format, order-of-magnitude different substance. Three measurable criteria: depth of coverage — direct dependencies only, or transitive ones too? Are static linking, vendored code and copied snippets visible? Manifest-derived SBOMs record declared composition and can diverge substantially from reality; accuracy — name and version errors amplify downstream, since one wrong version digit distorts the whole vulnerability mapping; and freshness — is the SBOM regenerated with every build? A stale inventory manufactures false confidence exactly when you need truth.

And pair it with VEX: the SBOM answers "which components," VEX answers "which of their vulnerabilities are actually exploitable here" — not_affected, affected, fixed, under_investigation. Shipping an SBOM without VEX simply transfers thousands of CVE triage decisions to your customer.

Three closing cautions: don't chase maximal depth before top-level accuracy; never maintain SBOMs by hand — their shelf life is measured in weeks; and don't wait for the regulation to reach you — building the program takes longer than the compliance deadline gives you.