Software Bill of Materials

Definition [edit]

The National Telecommunications and Information Administration (NTIA) defines an SBOM as a "formal record containing the details and supply chain relationships of various components used in building software."^[3] This definition encompasses three key attributes:

• Completeness — the inventory should identify all third-party and open-source components, as well as transitive dependencies.
• Machine-readability — SBOMs should be consumable by automated tooling, enabling integration into CI/CD pipelines and vulnerability scanning workflows.
• Supply chain relationships — component provenance, including supplier, version, and licensing metadata, must be captured.

The NTIA identified a minimum viable SBOM consisting of seven data fields: supplier name, component name, version of the component, other unique identifiers, dependency relationship, author of the SBOM data, and timestamp.^[4]

1.1 Core Components [edit]

An SBOM typically records the following data for each software component:

History [edit]

The concept of SBOMs evolved from practices in the software composition analysis (SCA) community, which had long advocated for component transparency in software supply chains.

2.1 NTIA Initiative (2018–2021) [edit]

In 2018, the NTIA launched a multistakeholder process on software transparency, convening government agencies, industry representatives, and academics to develop SBOM frameworks. The process produced a series of framing documents defining the minimum elements and use cases for SBOMs.

2.2 Executive Order 14028 (2021) [edit]

Following the SolarWinds supply chain attack and subsequent high-profile incidents, US President Biden signed Executive Order 14028 in May 2021, mandating that software vendors providing software to federal agencies must provide SBOMs. This represented the first national-level regulatory requirement for SBOMs.^[5]

2.3 EU Cyber Resilience Act (2022–2024) [edit]

The European Union's Cyber Resilience Act, proposed in 2022 and finalized in 2024, includes provisions requiring manufacturers of products with digital elements to maintain SBOMs and make them available to market surveillance authorities. This extended SBOM requirements beyond the US federal market to any vendor selling digital products in the EU.^[6]

Formats [edit]

Three primary SBOM formats are in widespread use. Each format targets different use cases and ecosystems, though interoperability between them is an active area of standardization.

SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: example-sbom
DocumentNamespace: https://example.com/sbom/example-1.0

PackageName: example-lib
SPDXID: SPDXRef-Package
PackageVersion: 1.0.0
PackageDownloadLocation: https://github.com/example/lib
FilesAnalyzed: false
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example:lib:1.0.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-lib@1.0.0

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "timestamp": "2024-01-15T12:00:00Z",
    "tools": [{"vendor": "Syft", "name": "syft", "version": "0.100.0"}]
  },
  "components": [{
    "type": "library",
    "name": "example-lib",
    "version": "1.0.0",
    "purl": "pkg:npm/example-lib@1.0.0",
    "licenses": [{"license": {"id": "MIT"}}]
  }]
}

Regulations and Mandates [edit]

SBOM adoption has been significantly accelerated by government regulations, particularly in the United States and the European Union.

4.1 United States [edit]

Executive Order 14028 (Improving the Nation's Cybersecurity, May 2021) directed the National Institute of Standards and Technology (NIST) to issue guidance on software supply chain security, which explicitly included SBOMs as a required element. The Office of Management and Budget (OMB) subsequently issued memorandum M-22-18, requiring agencies to obtain SBOMs from software vendors.^[5]

The Cybersecurity and Infrastructure Security Agency (CISA) has published SBOM Sharing Lifecycle Reports and maintains the SBOM-a-Rama community forum to advance SBOM practices.

4.2 European Union [edit]

The EU Cyber Resilience Act (CRA, Regulation 2024/2847) requires manufacturers of products with digital elements to maintain SBOMs and provide them to market surveillance authorities upon request. The CRA applies to any product with digital elements placed on the EU market, regardless of where it is manufactured.^[6]

Use Cases [edit]

The NTIA identified several primary use cases for SBOMs, which define the requirements and workflows that SBOM tooling must support.

Tools and Ecosystem [edit]

A broad ecosystem of open-source and commercial tools supports SBOM generation, analysis, and distribution.

6.1 Generation Tools [edit]

• Syft — Anchore's open-source SBOM generator supporting container images, filesystems, and packages. Outputs SPDX and CycloneDX.
• cdxgen — OWASP's CycloneDX generator supporting 20+ languages and package managers.
• SPDX Tools — Reference implementation tooling from the Linux Foundation for creating and validating SPDX documents.
• Trivy — Aqua Security's scanner that generates SBOMs alongside vulnerability reports.
• Microsoft SBOM Tool — Microsoft's open-source SBOM generation tool integrated with Azure DevOps.

6.2 Analysis and Consumption [edit]

• Grype — Anchore's vulnerability scanner that consumes SBOMs to identify known vulnerabilities.
• GUAC (Graph for Understanding Artifact Composition) — Google/OpenSSF project for aggregating and querying software supply chain metadata.
• Dependency-Track — OWASP's continuous component analysis platform for consuming and monitoring SBOMs.

See Also [edit]

• Software Composition Analysis
• Software Supply Chain Security
• CVE (Common Vulnerabilities and Exposures)
• SLSA Framework
• Sigstore
• Package URL (PURL)
• OpenSSF