sBOM
An SBOM, or Software Bill of Materials, is a formal record that inventories the components used to build a software product. It aims to improve transparency of the software supply chain by listing constituent parts, their versions, and relationships, along with information about licensing and provenance. SBOMs support risk assessment, vulnerability management, and compliance activities.
A typical SBOM enumerates components, credentials, versions, suppliers, licenses, and, where available, hashes and dependencies. It
Standards and formats for SBOMs include SPDX (Software Package Data Exchange), CycloneDX, and SWID tags. These
SBOMs are typically generated by software suppliers or during procurement, using software composition analysis tools and
Regulatory and industry contexts have increasingly promoted SBOM use. In the United States, government directives and
Limitations include gaps in scope, especially for dynamic or runtime components, incomplete data, and inconsistencies between