What Is an SBOM? Software Bill of Materials

Last verified on Nov 8, 2026.

An SBOM, or software bill of materials, is a list of the components that make up a piece of software. CISA describes it as a nested inventory, an ingredients list. NIST defines it as a formal record containing the details and supply chain relationships of the components used in building software.

The value shows up on the day a new CVE lands. If you hold SBOMs for what you ship and run, "are we affected?" becomes a query instead of a scramble. Log4Shell showed why. The joint government advisory on it told organizations to begin by identifying the assets affected, and that is the question an SBOM answers in advance.

What an SBOM Contains

Software is roughly hierarchical: components can have subcomponents, which have their own. An SBOM records each component with enough data to identify it and how it connects to others. A short CycloneDX example:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "components": [
    {
      "type": "library",
      "bom-ref": "log4j-core",
      "group": "org.apache.logging.log4j",
      "name": "log4j-core",
      "version": "2.14.1",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1",
      "licenses": [{ "license": { "id": "Apache-2.0" } }]
    }
  ],
  "dependencies": [{ "ref": "log4j-core", "dependsOn": [] }]
}

The purl is a package URL, a compact identifier that lets a tool match the component to an advisory.

Minimum Elements: 2021 and 2026

The 2021 NTIA report, issued under Executive Order 14028, set seven data fields: supplier, component name, version, other unique identifiers, dependency relationship, SBOM author, and timestamp. On July 29, 2026, CISA, NSA, FBI, and international partners published the 2026 Minimum Elements, which update and replace the NTIA version.

The 2026 table has 17 data fields. Eight describe each component: producer, name, version, identifiers, hash value, hash algorithm, license, and dependency relationship. Nine describe the SBOM: author, author signature, timestamp, version, tool name, tool version, data format name, data format version, and generation context. The new ones include hashes, license, signature, and generation context, meaning the lifecycle phase when the SBOM was made, such as before build or after build.

It also covers practices: machine-processable data, coverage (breadth as well as depth), explicit marking of unknown information, frequency, and distribution. SWID tags are dropped from the list of named formats.

SPDX and CycloneDX

CISA names two data formats as widely used for generating and consuming SBOMs: SPDX and CycloneDX. Both come from open, international processes and are machine-processable and human-readable. The guidance says to support all widely used, open formats and to reassess them over time. SPDX license identifiers are also the suggested way to state a component's license.

From SBOM to Vulnerability Answer

An SBOM is data about components, and by itself does not list vulnerabilities. The 2026 guidance describes the next step: correlate it with security advisories. After learning of a new vulnerability, an organization can check whether its SBOMs contain the component, which the guidance says significantly improves response time.

Two terms help here. VEX (Vulnerability Exploitability eXchange) is an attestation from a producer saying whether its products are affected by a given vulnerability. It narrows a long list of "present" components to the ones that matter. To see which vulnerabilities are being exploited right now, check CISA KEV.

A dependency inventory also catches the supply-chain side: when a package is later found compromised, the question is the same ("do we use it?"). See supply chain attacks and what to do about a compromised npm package.

Limits

An SBOM is only as good as its coverage. A lockfile lists the packages for one project. It says nothing about a vendor appliance or the operating system under a container. Treat a clean match as "no known advisory for the versions we listed", not as proof of safety, and regenerate on each build because the data goes stale.

Checking Your Stack on cve.now

If you do not have an SBOM yet, a lockfile is a start. cve.now, a free vulnerability feed from Sazabi, matches package names, ecosystems, and pinned versions in a lockfile against affected version ranges. You get a report and a feed of only the vulnerabilities that affect your packages. Upload a lockfile on cve.now, browse Log4j advisories, or follow the check your stack guide. Sazabi, an AI-native observability and security platform, also runs a cve.now MCP server so coding agents can run the same check. For ongoing watch on advisories, see new advisories.