What is an SBOM?

A software bill of materials (SBOM) is, in the words of Executive Order (EO) 14028, "a formal record containing the details and supply chain relationships" of the components used to build software. The order, signed May 12, 2021, likens it to an ingredients list. Section 4 gave the Department of Commerce and the National Telecommunications and Information Administration (NTIA) 60 days to publish minimum elements for an SBOM, and NTIA's report is dated July 12, 2021. On July 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and its partners published 2026 minimum elements that update and replace the NTIA version.

Where the requirement came from

Subsection 4(e) of the order, in the section titled Enhancing Software Supply Chain Security, told the Secretary of Commerce, acting through the Director of the National Institute of Standards and Technology (NIST), to issue guidance on practices that enhance supply chain security. Item (vii) on that list is providing a purchaser an SBOM for each product, directly or by publishing it on a public website. Subsection 4(f) set the 60-day deadline for the minimum elements.

The purchasing rule has since changed. Office of Management and Budget (OMB) memorandum M-26-05, dated January 23, 2026, rescinded the earlier memoranda M-22-18 and M-23-16. Agencies may choose contract terms that require a software producer to provide a current SBOM upon request. For a cloud platform, the memo says the term should call for an SBOM of the runtime production environment.

The 2021 minimum elements

The NTIA report grouped the minimum elements into three areas. Data fields were seven pieces of baseline information about each component: Supplier Name, Component Name, Version of the Component, Other Unique Identifiers, Dependency Relationship, Author of SBOM Data, and Timestamp. Author of SBOM Data means the source of the descriptive data, not the author of the software. Automation support meant machine-readable formats, and the report named three: Software Package Data eXchange (SPDX), CycloneDX, and Software Identification (SWID) tags. An SBOM conveyed across organizational boundaries had to use one of them.

Practices and processes were six: Frequency, Depth, Known Unknowns, Distribution and Delivery, Access Control, and Accommodation of Mistakes. A new build or release needed a new SBOM. At a minimum, all top-level dependencies had to be listed in enough detail to find the transitive ones. Where the dependency graph was incomplete, the author had to say so, and the default interpretation was that the data is incomplete. Executables on endpoints could carry the SBOM on disk with the compiled code.

The 2026 update

The CISA document's version history lists 1.0 on July 12, 2021, 2.0 as the August 22, 2025 draft, and 2.1 on July 29, 2026. The co-authors include the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and partner organizations from Australia, Canada, the Czech Republic, France, Germany, India, Italy, Japan, the Republic of Korea, the Netherlands, New Zealand, Poland, and Slovakia.

New data fields include SBOM Author Signature, SBOM Generation Context, SBOM Tool Name and Version, SBOM Version, Component Hash Value and Algorithm, and Component License. Supplier Name becomes Component Producer, because supplier proved ambiguous around distributors of software. Depth becomes Coverage: an SBOM should include all components, including transitive dependencies, with no minimum depth. Known Unknowns becomes Explicitly Identifying Unknown Information, which separates what the author does not know from what the author withholds. Access Control is removed as a separate element, and SWID tags are dropped, leaving SPDX and CycloneDX as the two formats in wide use.

SPDX and CycloneDX

SPDX describes itself as an open standard for communicating SBOM information, including provenance, license, and security data, and its specification is the international standard ISO/IEC 5962:2021. The project history dates the SPDX 3.0.0 release to April 2024. The 2021 NTIA report expanded the name as Software Package Data eXchange; the SPDX home page now uses System Package Data Exchange.

CycloneDX is developed by the OWASP Foundation and Ecma International. The specification page lists version 1.7, released October 21, 2025, with JSON, XML, and Protocol Buffers encodings, and ECMA-424, 2nd edition, December 2025, defines CycloneDX v1.7. For software bound for a disconnected network, two parts of the object model stand out: services, which describe external application programming interfaces (APIs) the software may call and their endpoints, and compositions, which record whether an inventory is complete, incomplete, or unknown.

What an SBOM does not tell a buyer

The source documents are plain about what an SBOM leaves out.

• Whether a vulnerability matters. NTIA called SBOM data primarily static, a point-in-time record, while vulnerability data changes. It described the Vulnerability Exploitability eXchange (VEX), which says whether a product is affected by a given vulnerability. The 2026 document points to VEX and Common Security Advisory Framework (CSAF) advisories for that job.
• Whether the list is accurate. The 2026 document says the author signature assures the recipient that the SBOM arrived as its author created it. Accuracy, coverage, and completeness are out of its scope, and it suggests binary analysis tools to find components the SBOM does not list.
• Everything in a cloud service. NTIA said direct SBOM delivery is less practical for fast-changing web applications and recommended, in the short run, that cloud providers assert they keep an internal SBOM.
• What the author withholds. Under the 2026 elements, the author should say whether missing information is unknown or withheld, and an organization may consider an SBOM incomplete if essential data is withheld.

What to check

• Does the SBOM meet the 2021 NTIA elements or the July 29, 2026 CISA set, with its author signature, hashes, and generation context?
• Is it in SPDX or CycloneDX, and in a format version its maintainers have not deprecated?
• Does it cover transitive dependencies, and does it say which information is unknown and which is withheld?
• Does a new SBOM come with each release and accompany the installed software?
• Does the vendor publish VEX or other advisories on whether listed vulnerabilities affect the product?
• Does the contract require a current SBOM on request, and for a cloud platform, one of the runtime production environment?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Sources

1. 1Executive Order 14028 of May 12, 2021, Improving the Nation's Cybersecurity · Federal Register, Vol. 86, No. 93 (May 17, 2021), via govinfo.gov
2. 2The Minimum Elements For a Software Bill of Materials (SBOM) · U.S. Department of Commerce and NTIA, July 12, 2021
3. 32026 Minimum Elements for a Software Bill of Materials (SBOM) · CISA, NSA, FBI, and international partners, July 29, 2026
4. 4M-26-05, Adopting a Risk-based Approach to Software and Hardware Security · Office of Management and Budget, January 23, 2026
5. 5About SPDX: Overview · SPDX project, The Linux Foundation
6. 6The System Package Data Exchange (SPDX) · SPDX project, The Linux Foundation
7. 7Specification Overview · OWASP CycloneDX
8. 8ECMA-424, CycloneDX Bill of materials specification, 2nd edition · Ecma International, December 2025

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.