SBOMs are required or requested by federal software buyers, EU regulators under the Cyber Resilience Act, healthcare and medical-device stakeholders, critical infrastructure sectors, enterprise procurement teams, and customers reviewing software supply chain risk.

Frequently Asked Questions

Q: Why do I need an SBOM?

SBOMs are increasingly required for regulatory compliance (US Executive Order, EU CRA), supply chain security, vulnerability management, and license compliance. They help identify and remediate security vulnerabilities quickly and ensure transparency in software components.

Q: What SBOM formats should I use?

The two main SBOM formats are SPDX (Software Package Data Exchange) and CycloneDX. SPDX is an ISO standard focused on license compliance, while CycloneDX is designed for security use cases. Choose based on your primary use case and ecosystem requirements.

Q: How do I generate an SBOM?

Generate an SBOM with a tool that understands your technology stack, such as Syft, CycloneDX CLI, SPDX Tools, npm sbom, cyclonedx-bom for Python, Maven CycloneDX plugins, Gradle plugins, or container tools like Syft and Trivy.

Q: When should I generate SBOMs?

Generate SBOMs during CI/CD builds, before production releases, when distributing software to customers, after dependency updates, and when preparing compliance or supplier-security evidence.

Q: Where should I store SBOMs?

Store SBOMs with the release artifact they describe, such as in an artifact repository, version-control release record, package registry, dedicated SBOM management platform, or access-controlled cloud storage.

Q: What is Executive Order 14028?

Executive Order 14028 is a US cybersecurity directive signed in May 2021 that pushed federal agencies and software suppliers toward stronger secure software practices, including SBOM availability for software supplied to the federal government.

Q: What is the EU Cyber Resilience Act?

The EU Cyber Resilience Act establishes cybersecurity requirements for products with digital elements sold in the EU, including vulnerability handling, security support, technical documentation, and machine-readable SBOM expectations.

Q: Can I convert between SBOM formats?

Yes. Tools such as CycloneDX CLI, SPDX Tools, online converters, and custom scripts can convert between SBOM formats, although some format-specific fields may not map cleanly between standards.

General Questions

What is a Software Bill of Materials (SBOM)?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all components, libraries, and dependencies in a software application. It provides transparency into the software supply chain, helping organizations manage security, licensing, and compliance risks.

Think of it like an ingredients list for software - it tells you exactly what's inside your application.

Why do I need an SBOM?

SBOMs are increasingly required for:

Regulatory Compliance: US Executive Order 14028, EU Cyber Resilience Act
Security: Quickly identify and patch vulnerable components
License Management: Ensure compliance with open source licenses
Supply Chain Transparency: Know exactly what's in your software
Risk Management: Assess and mitigate supply chain risks

Who requires SBOMs?

Various stakeholders require or benefit from SBOMs:

US Federal Government (Executive Order 14028)
EU regulators (Cyber Resilience Act)
Healthcare organizations (FDA requirements)
Automotive industry (ISO/SAE 21434)
Critical infrastructure sectors
Enterprise customers evaluating software

Technical Implementation

How do I generate an SBOM?

You can generate SBOMs using various tools depending on your technology stack:

Multi-language: Syft, CycloneDX CLI, SPDX Tools
JavaScript: npm sbom, @cyclonedx/bom
Python: pip-audit, cyclonedx-bom
Java: Maven CycloneDX Plugin, Gradle SPDX Plugin
Container: Syft, Grype, Trivy

Most tools can be integrated into CI/CD pipelines for automatic generation.

When should I generate SBOMs?

Generate SBOMs at these key points:

During each build in your CI/CD pipeline
Before releasing software to production
When distributing software to customers
After updating dependencies
For compliance audits and assessments

Where should I store SBOMs?

Store SBOMs in a centralized, accessible location:

Artifact repositories (Artifactory, Nexus)
Version control systems (alongside code)
Dedicated SBOM management platforms
Package registries (npm, PyPI, Maven Central)
Cloud storage with proper access controls

Ensure SBOMs are versioned and associated with specific software releases.

Compliance & Regulations

What is Executive Order 14028?

Executive Order 14028, signed in May 2021, requires federal software suppliers to provide SBOMs. Key requirements include:

Providing SBOMs for all software sold to the federal government
Using industry-standard formats (SPDX or CycloneDX)
Including minimum required fields defined by NTIA
Maintaining SBOMs throughout the software lifecycle

What is the EU Cyber Resilience Act?

The EU Cyber Resilience Act (CRA) mandates cybersecurity requirements for products with digital elements, including:

Providing machine-readable SBOMs
Vulnerability disclosure and patching
Security support throughout product lifecycle
CE marking for compliance

The CRA applies to most software and IoT products sold in the EU market.

Tools & Formats

What SBOM formats should I use?

The two main SBOM formats are:

SPDX: ISO/IEC 5962:2021 standard, focused on license compliance
CycloneDX: OWASP project, designed for security use cases

Choose based on your primary use case:

License compliance → SPDX
Security/vulnerability management → CycloneDX
Both → Generate both formats or use tools that support conversion

Can I convert between SBOM formats?

Yes, you can convert between formats using various tools:

CycloneDX CLI (supports multiple format conversions)
SPDX Tools (Java, Python implementations)
Online converters and APIs
Custom scripts using format libraries

Note that some format-specific fields may not have direct equivalents in other formats.

Security & Vulnerabilities

How do SBOMs help with vulnerability management?

SBOMs enhance vulnerability management by:

Providing complete component inventory for scanning
Enabling rapid identification of affected systems
Supporting automated vulnerability detection
Facilitating impact assessment and prioritization
Tracking patch deployment across systems

When a new vulnerability is discovered (like Log4Shell), SBOMs help you quickly identify all affected applications.

Should SBOMs include vulnerability information?

It depends on your use case:

Build-time SBOMs: Usually don't include vulnerabilities
Runtime SBOMs: May include known vulnerabilities
VEX (Vulnerability Exploitability eXchange): Separate document for vulnerability status

CycloneDX supports embedded vulnerability information, while SPDX typically uses separate VEX documents.