SBOM

An SBOM, or Software Bill of Materials, is a formal record that inventories the components used to build a software product. It aims to improve transparency of the software supply chain by listing constituent parts, their versions, and relationships, along with information about licensing and provenance. SBOMs support risk assessment, vulnerability management, and compliance activities.

A typical SBOM enumerates components, credentials, versions, suppliers, licenses, and, where available, hashes and dependencies. It may also capture provenance data, such as build environments and software origin, and link to advisories and vulnerability information relevant to each component.

Standards and formats for SBOMs include SPDX (Software Package Data Exchange), CycloneDX, and SWID tags. These formats differ in structure and granularity, but share the goal of enabling machine-readable exchange and automated analysis. Organizations may use multiple formats or convert between them.

SBOMs are typically generated by software suppliers or during procurement, using software composition analysis tools and build processes. They require ongoing maintenance to reflect updates, patches, new dependencies, or decommissioned components across the software lifecycle.

Regulatory and industry contexts have increasingly promoted SBOM use. In the United States, government directives and policy initiatives have encouraged SBOM adoption to improve software supply chain security; similar efforts are seen in other regions and among industry groups.

Limitations include gaps in scope, especially for dynamic or runtime components, incomplete data, and inconsistencies between formats. When combined with continuous vulnerability scanning and governance, SBOMs provide useful insight into software risk.