DataTerminology.comNEW
Also known as: Software Bill of Materials
A structured list of components and dependencies used to build software or AI systems.
DESCRIPTION
A Software Bill of Materials (SBOM) inventories the components, libraries, and dependencies in an application, enabling visibility into software supply chains. SBOMs support vulnerability management, license compliance, and incident response. Common formats include SPDX and CycloneDX, and policies increasingly mandate SBOMs for critical software. SBOMs can be generated during CI/CD and distributed with releases. They align with SLSA and provenance attestations to strengthen supply chain assurance.
ALTERNATIVE DEFINITIONS
CISA
A Software Bill of Materials (SBOM) is a nested inventory, a list of ingredients that make up software components.
Stresses nested inventory for software components as an ingredient list.
NTIA
An SBOM is a formal record containing the details and supply chain relationships of components used in building software.
Highlights formal record of components and their supply chain relationships.
SPDX (Linux Foundation)
The Software Package Data Exchange (SPDX) standard provides a common format for communicating SBOM information, including components, licenses, and security references.
Defines a standardized SBOM format for interoperability across tools.
RELATED TERMS
Supply Chain Security Dependency Management Vulnerability Management SBOM Software Composition Analysis SLSA Provenance Package Manager
COMPETING TERMS
SPDX CycloneDX
KNOWLEDGE AREAS
Data Security Software Engineering Platform & Tooling Data Management
TARGET AUDIENCE
DevOps Engineer Software Developer Security Architect Cybersecurity Engineer Chief Information Security Officer Application Administrator IT Manager
EXTERNAL SOURCES
- Wikipedia - Software bill of materials
- CISA - US guidance and resources on SBOM
- NTIA - Minimum elements for SBOMs
- SPDX - SPDX SBOM specification
- CycloneDX - CycloneDX SBOM standard overview
TOP QUESTIONS
Why is a Bill of Materials important for software?
It provides transparency into dependencies, enabling rapid vulnerability response and license compliance. Without it, organizations struggle to assess exposure during supply-chain incidents.
Category: Relevancy
What is the difference between SPDX and CycloneDX for a Bill of Materials?
Both are SBOM standards; SPDX originated with the Linux Foundation, while CycloneDX emerged from OWASP. They differ in schema, focus, and tooling ecosystems.
Category: Alternatives
How do I generate an SBOM Bill of Materials?
Use build-time tools and package managers or scanners integrated into CI/CD. Many ecosystems provide SBOM exporters for SPDX or CycloneDX formats.
Category: HowTo
What risks arise without a Bill of Materials?
Unknown dependencies delay patching and incident response. Compliance issues and hidden vulnerabilities lead to security breaches and reputational harm.
Category: Risk
Where is a Bill of Materials stored and shared?
Store SBOMs as artifacts in registries or release packages and share with customers or regulators. Automate updates for each build or version.
Category: Management
Does a Bill of Materials include transitive dependencies?
Yes, SBOMs should enumerate direct and transitive components to fully capture the dependency graph and vulnerabilities.
Category: Requirements
How does a Bill of Materials relate to SLSA or attestations?
SBOMs list components, while SLSA and attestations prove build integrity and provenance. Together, they strengthen supply-chain assurance.
Category: Example
What fields are commonly included in a Bill of Materials?
Identifiers, versions, licenses, supplier, checksums, and vulnerability references are typical. Standards define schemas and minimum elements.
Category: Requirements
Is a Bill of Materials required by regulation?
Requirements are emerging in government procurement and critical software contexts. Agencies like CISA and NTIA publish guidance encouraging SBOM adoption.
Category: Opinion