Software Bill of Materials (SBOM)

Software developers and vendors often build products by assembling existing open source and commercial components, and an SBOM enumerates those components. They include libraries and modules, and can be open source or proprietary, free or paid. An SBOM is roughly hierarchical. Software consists of components, and each component may have subcomponents of its own. First-party components come from the party writing the SBOM, and third-party components come from an external source.

SBOMs serve those who produce, choose, and operate software. Producers use them to build and maintain their software, including upstream components. Buyers use them to inform pre-purchase assurance and plan implementation. Operators use them for vulnerability management, asset management, licensing and compliance, and to identify component dependencies and supply chain risks.

When a vulnerability is found in a component, an SBOM lets an organization quickly identify the software that contains it, assess how it is used, and understand the risk, and also identify software that is not affected. A related concept, the Vulnerability Exploitability eXchange (VEX), is a form of security advisory that states whether a product is affected by a known vulnerability.

The two data formats most widely used to generate and consume SBOMs are SPDX and CycloneDX. Both are products of open, international processes, and both are machine-processable and human-readable.