What is SBOM?

An SBOM lists the components that make up a piece of software. This entry follows the 2021 NTIA report on minimum elements, produced under US Executive Order 14028. It covers only that report and does not reflect any later guidance on SBOM minimum elements.

The report groups its minimum elements into three areas. The first is data fields recorded for each component: supplier, component name, version, other unique identifiers, dependency relationship, author of the SBOM data, and a timestamp. The second is automation support, meaning the SBOM should be machine-readable and easy to generate at scale, and the report names SPDX, CycloneDX, and SWID tags as data formats. The third is practices and processes, such as how often an SBOM is updated and how deeply it lists transitive components.

The report says an SBOM helps producers, buyers, and operators understand the supply chain, most notably by making it possible to track known and newly emerged vulnerabilities. It also states a limit: an SBOM will not solve all software security problems and is meant as a foundation for other tools and practices.