What is SBOM?

An SBOM (Software Bill of Materials) is a record of the components that a piece of software consists of. It is often compared to a list of ingredients: it shows which libraries, modules, frameworks and other dependencies were used to build an application, with name, version and supplier.

An SBOM is machine-readable. It is created by one tool and read by others, which compare its content against databases of known vulnerabilities and licences.

What an SBOM looks likeCopy Anchor Link

An SBOM is a file, usually JSON. This is a shortened example in the CycloneDX format with a single component:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "components": [
    {
      "type": "library",
      "name": "log4j-core",
      "version": "2.14.1",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
    }
  ]
}

A real SBOM often contains hundreds or thousands of components and also describes how they depend on each other. What is in an SBOM? goes through the fields.

What an SBOM is used forCopy Anchor Link

• Vulnerability management. When a vulnerability becomes known in a library, the SBOMs show which products and versions contain it. Without SBOMs, the question is answered by going through each system by hand.
• Licences. The SBOM shows which licences the components have, so that terms that cannot be combined with the product are found before delivery.
• Procurement and supplier follow-up. An SBOM from the supplier shows what purchased software contains, even when the source code is not available.
• Compliance. The Cyber Resilience Act (CRA) requires manufacturers to draw up an SBOM from 11 December 2027.

BackgroundCopy Anchor Link

Bills of materials have long been used in manufacturing to keep track of the parts a product consists of. For software, the work was driven from 2018 by the US agency NTIA together with industry. After Executive Order 14028, NTIA published a baseline in 2021 for what an SBOM must contain, the SBOM Minimum Elements.

In the EU, the CRA is the first regulation that makes the SBOM a legal requirement.

FormatsCopy Anchor Link

The two formats in practical use are CycloneDX and SPDX. Both are open standards. SBOM formats and standards describes the differences.

SBOMs at different stagesCopy Anchor Link

An SBOM can be created at different points in time, and the content differs. An SBOM from the source code lists the dependencies that are declared. An SBOM from the build lists the components that were actually included. An SBOM from a running system lists what is installed and running. Different types of SBOMs describes the six types.

Other types of BOMCopy Anchor Link

The same idea is used for other things than software components. CycloneDX defines the following, among others:

VEX is not a bill of materials but a companion to one: a document that states whether a product is affected by a specific vulnerability.