SBOM Glossary

Key terms and definitions in the Software Bill of Materials ecosystem

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A

API (Application Programming Interface)

A set of protocols and tools for building software applications, often documented in SBOMs for integration dependencies.

Artifact

A deployable component of software, such as a compiled binary, library, or container image that may be inventoried in an SBOM.

Attribution

Information about the origin, authorship, and licensing of software components included in an SBOM.

B

BOM (Bill of Materials)

A comprehensive list of raw materials, components, and assemblies required to build a product. In software context, see SBOM.

Build Environment

The toolchain, dependencies, and configuration used to compile and package software, often documented in build-time SBOMs.

C

Component

A unit of software such as a library, framework, or module that is included in a larger software application and documented in an SBOM.

CPE (Common Platform Enumeration)

A standardized method of describing and identifying applications, operating systems, and hardware devices, used in SBOMs for component identification.

CRA (Cyber Resilience Act)

EU legislation requiring cybersecurity measures for products with digital elements, including SBOM requirements for software transparency.

CVE (Common Vulnerabilities and Exposures)

A standardized identifier for known security vulnerabilities, used to track vulnerable components identified through SBOM analysis.

CycloneDX

An OWASP standard for SBOM format designed specifically for security use cases and supply chain component analysis.

D

Dependency

A software component that another component requires to function properly, forming the dependency tree documented in SBOMs.

Dependency Graph

A visual or data representation showing the relationships between software components and their dependencies.

Direct Dependency

A component explicitly declared and directly used by your software, as opposed to transitive dependencies.

E

EO 14028 (Executive Order 14028)

US Presidential Executive Order on Improving the Nation's Cybersecurity, requiring SBOMs for federal software suppliers.

EUPL (European Union Public License)

An open-source license created by the European Commission, often tracked in SBOMs for compliance purposes.

F

FDA (Food and Drug Administration)

US regulatory agency that requires SBOMs for certain medical device software as part of cybersecurity guidelines.

FOSS (Free and Open Source Software)

Software with source code that anyone can inspect, modify, and enhance, commonly inventoried in SBOMs with license information.

G

Graph Database

A database designed to store and query relationships between entities, useful for managing complex SBOM dependency relationships.

H

Hash

A cryptographic fingerprint of a file or component, used in SBOMs to uniquely identify and verify component integrity.

I

ISO/IEC 5962:2021

International standard for SPDX specification, providing guidelines for communicating software bill of materials information.

L

License

Legal terms under which software can be used, modified, and distributed, a critical component of SBOM documentation.

License Compliance

Adherence to the terms and conditions of software licenses, verified through SBOM analysis.

M

Metadata

Descriptive information about software components including version, author, license, and other attributes captured in SBOMs.

Minimum Elements

The baseline required fields for an SBOM as defined by NTIA, including supplier name, component name, version, and other identifiers.

N

NTIA (National Telecommunications and Information Administration)

US agency that published minimum elements for SBOM and facilitates SBOM standards development.

NVD (National Vulnerability Database)

US government repository of vulnerability data used to identify security issues in SBOM components.

O

OSS (Open Source Software)

Software with publicly available source code, commonly documented in SBOMs with associated license information.

OWASP

Open Web Application Security Project, maintainer of the CycloneDX SBOM standard.

P

Package

A distribution format for software components, typically including code, metadata, and dependencies.

Package Manager

Tools like npm, pip, or Maven that manage software dependencies and can generate SBOMs.

Pedigree

The origin and history of a software component, including its supply chain journey documented in SBOMs.

PURL (Package URL)

A standardized way to identify and locate software packages across different ecosystems, used in SBOMs.

S

SBOM (Software Bill of Materials)

A formal record containing details and supply chain relationships of components used in building software.

SCA (Software Composition Analysis)

Tools and processes that analyze software to identify components, licenses, and vulnerabilities for SBOM generation.

SPDX (Software Package Data Exchange)

An ISO standard format for communicating SBOM information, focusing on license compliance.

SWID (Software Identification Tag)

ISO/IEC 19770-2 standard for software asset management, can be used as an SBOM format.

Supply Chain

The network of organizations, resources, and processes involved in creating and delivering software.

T

Transitive Dependency

An indirect dependency that your software requires through another dependency, captured in comprehensive SBOMs.

Transparency

The principle of making software composition visible and understandable through SBOMs.

V

VDR (Vulnerability Disclosure Report)

A document detailing security vulnerabilities in software components, often linked to SBOM data.

VEX (Vulnerability Exploitability eXchange)

A companion document to SBOMs that provides additional context about vulnerability applicability and mitigation status.

Version

The specific release or iteration of a software component, a required field in SBOM documentation.

Vulnerability

A weakness in software that could be exploited to compromise security, tracked via SBOM component analysis.