RESOURCES · GUIDE

What is an SBOM (Software Bill of Materials)?

An SBOM is the ingredients list of your software: every component, version and dependency relationship, in a machine-readable format. Here is what it must contain, which format to use, and how to keep it true.

What goes into an SBOM

The CISA minimum elements define the floor: supplier name, component name, version, unique identifiers (such as PURL or CPE), dependency relationships, SBOM author, and timestamp. A useful SBOM goes deeper — covering transitive dependencies, container layers and, for embedded products, binary components with no source available.

The two formats

SPDX (ISO/IEC 5962) has the strongest license-compliance lineage; CycloneDX grew out of the security tooling world. Both cover the minimum elements, both are machine-readable, and both are accepted by essentially every regulation and customer request. Good tooling exports both from the same scan — the format question should never drive your tool choice. See the full comparison.

Who asks for SBOMs — and why

Three audiences: regulators (EO 14028 procurement, EU CRA, FDA), customers (enterprise procurement and OEM supply chains writing SBOM delivery into contracts), and your own security team — because when the next Log4Shell lands, the SBOM is what turns "are we affected?" from a week of archaeology into a minute of lookup.

How SBOMs are generated

Three routes, in ascending order of depth: build-tool exports (fast, manifest-only), SCA-generated SBOMs (adds transitive resolution, snippet-level findings and license data — see What is SCA?), and binary composition analysis for artifacts without source. The common failure mode is treating the SBOM as a release deliverable produced by hand: embed generation in CI so every build emits one automatically.

Beyond the inventory: VEX

An SBOM says what you contain; it does not say which vulnerabilities actually affect you. That is the role of VEX (Vulnerability Exploitability eXchange) — machine-readable statements ("affected" / "not affected" / "fixed") that ride alongside the SBOM and cut your customers' triage burden dramatically.

FAQ

Does an SBOM include my proprietary code?

It inventories components — overwhelmingly the third-party and open source ones. Your proprietary modules appear as top-level entries without exposing source code.

How often should an SBOM be regenerated?

Every build. An SBOM produced at release and never updated drifts from reality with the first hotfix.