A
API (Application Programming Interface)
A set of protocols and tools for building software applications, often documented in SBOMs for integration dependencies.
Artifact
A deployable component of software, such as a compiled binary, library, or container image that may be inventoried in an SBOM.
Attribution
Information about the origin, authorship, and licensing of software components included in an SBOM.
B
BOM (Bill of Materials)
A comprehensive list of raw materials, components, and assemblies required to build a product. In software context, see SBOM.
Build Environment
The toolchain, dependencies, and configuration used to compile and package software, often documented in build-time SBOMs.
C
Component
A unit of software such as a library, framework, or module that is included in a larger software application and documented in an SBOM.
CPE (Common Platform Enumeration)
A standardized method of describing and identifying applications, operating systems, and hardware devices, used in SBOMs for component identification.
CRA (Cyber Resilience Act)
EU legislation requiring cybersecurity measures for products with digital elements, including SBOM requirements for software transparency.
CVE (Common Vulnerabilities and Exposures)
A standardized identifier for known security vulnerabilities, used to track vulnerable components identified through SBOM analysis.
CycloneDX
An OWASP standard for SBOM format designed specifically for security use cases and supply chain component analysis.
D
Dependency
A software component that another component requires to function properly, forming the dependency tree documented in SBOMs.
Dependency Graph
A visual or data representation showing the relationships between software components and their dependencies.
Direct Dependency
A component explicitly declared and directly used by your software, as opposed to transitive dependencies.
E
EO 14028 (Executive Order 14028)
US Presidential Executive Order on Improving the Nation's Cybersecurity, requiring SBOMs for federal software suppliers.
EUPL (European Union Public License)
An open-source license created by the European Commission, often tracked in SBOMs for compliance purposes.
F
FDA (Food and Drug Administration)
US regulatory agency that requires SBOMs for certain medical device software as part of cybersecurity guidelines.
FOSS (Free and Open Source Software)
Software with source code that anyone can inspect, modify, and enhance, commonly inventoried in SBOMs with license information.
G
Graph Database
A database designed to store and query relationships between entities, useful for managing complex SBOM dependency relationships.
H
Hash
A cryptographic fingerprint of a file or component, used in SBOMs to uniquely identify and verify component integrity.
I
ISO/IEC 5962:2021
International standard for SPDX specification, providing guidelines for communicating software bill of materials information.
L
License
Legal terms under which software can be used, modified, and distributed, a critical component of SBOM documentation.
License Compliance
Adherence to the terms and conditions of software licenses, verified through SBOM analysis.
M
Metadata
Descriptive information about software components including version, author, license, and other attributes captured in SBOMs.
Minimum Elements
The baseline required fields for an SBOM as defined by NTIA, including supplier name, component name, version, and other identifiers.
N
NTIA (National Telecommunications and Information Administration)
US agency that published minimum elements for SBOM and facilitates SBOM standards development.
NVD (National Vulnerability Database)
US government repository of vulnerability data used to identify security issues in SBOM components.
O
OSS (Open Source Software)
Software with publicly available source code, commonly documented in SBOMs with associated license information.
OWASP
Open Web Application Security Project, maintainer of the CycloneDX SBOM standard.
P
Package
A distribution format for software components, typically including code, metadata, and dependencies.
Package Manager
Tools like npm, pip, or Maven that manage software dependencies and can generate SBOMs.
Pedigree
The origin and history of a software component, including its supply chain journey documented in SBOMs.
PURL (Package URL)
A standardized way to identify and locate software packages across different ecosystems, used in SBOMs.
S
SBOM (Software Bill of Materials)
A formal record containing details and supply chain relationships of components used in building software.
SCA (Software Composition Analysis)
Tools and processes that analyze software to identify components, licenses, and vulnerabilities for SBOM generation.
SPDX (Software Package Data Exchange)
An ISO standard format for communicating SBOM information, focusing on license compliance.
SWID (Software Identification Tag)
ISO/IEC 19770-2 standard for software asset management, can be used as an SBOM format.
Supply Chain
The network of organizations, resources, and processes involved in creating and delivering software.
T
Transitive Dependency
An indirect dependency that your software requires through another dependency, captured in comprehensive SBOMs.
Transparency
The principle of making software composition visible and understandable through SBOMs.
V
VDR (Vulnerability Disclosure Report)
A document detailing security vulnerabilities in software components, often linked to SBOM data.
VEX (Vulnerability Exploitability eXchange)
A companion document to SBOMs that provides additional context about vulnerability applicability and mitigation status.
Version
The specific release or iteration of a software component, a required field in SBOM documentation.
Vulnerability
A weakness in software that could be exploited to compromise security, tracked via SBOM component analysis.