SBOM: component information, formats and maintenance
Sytance · Updated
A software bill of materials (SBOM) describes the software components that make up an application or system and the relationships between them. It gives a team a starting point for component inventory, licence review and vulnerability investigation. Its value depends on how accurately it describes the software that was actually delivered.
The product described by an SBOM
An SBOM describes a particular product version, build or artefact, such as a firmware image or installation package. Component entries identify the libraries and other software within that scope. Their versions, producers, identifiers and relationships help explain what was included.
For a fictional industrial gateway, the firmware release is the target product. Its management application and embedded libraries are components. A remote telemetry service is an external dependency; describing it does not mean its server-side packages are contained in the firmware.
The public example uses invented components to make the structure readable. It is not a component inventory of Sytance or a released gateway.
Component identifiers
Two packages with similar names may belong to different package ecosystems. Package URL (purl) identifies a package using fields such as type, namespace, name and version. A file hash helps identify an exact file when the hashing algorithm and file being hashed are known.
Use package metadata or supplier information to establish identifiers. A purl assembled from a guessed vendor can point to the wrong package. Preserve the original version string because a downstream build may include its own patch revision.
SPDX and CycloneDX both represent software component information and relationships. The available fields and exact meaning depend on the format version. Choose a version that the producing and receiving tools can process.
Inventory accuracy and coverage
A file can be valid JSON and still describe the wrong release. Compare the SBOM with the build inputs and shipped artefact, then investigate discrepancies. A source dependency list can contain development tools that were never shipped and omit libraries copied into the image.
- Target: the product, version and artefact match the release.
- Identity: component versions and identifiers can be traced to evidence.
- Relationships: the dependency paths are present and meaningful.
- Coverage: missing supplier data and unanalysed parts are visible.
- Exchange: a receiving tool preserves the fields needed for the intended use.
The 2026 SBOM Minimum Elements
The 2026 SBOM Minimum Elements, jointly published by CISA and partner agencies, update the NTIA 2021 guidance. They address document metadata, component data and practices for maintaining and sharing SBOMs. The publication is guidance and states that it does not create new requirements.
For a delivery, state the agreed specification, format version and additional customer requirements. A schema validation result alone does not establish that the information requested by a customer is complete.
Vulnerability matches and product impact
A vulnerability match connects a reported issue with a component identity or version. The next question is whether the affected code exists and can be exploited in this product. Check build options, modifications, execution paths and the conditions described by the advisory.
Vulnerability Exploitability eXchange (VEX) communicates an assessment of a particular vulnerability for identified products. Keep that assessment linked to the release and supporting analysis. An absent match may reflect limited coverage or incomplete identifiers.
Records for supported releases
Archive the original inventory with the release. If new information corrects the SBOM without changing the software, issue a traceable document revision. If the software changes, create a record for the new release.
When a new advisory identifies a component vulnerability, search the inventories of all supported releases. Customers may still be running an older release whose components differ from the current product.