What is an SBOM? Software bill of materials, defined, with the 2026 minimum elements

A software bill of materials (SBOM) is a formal record of the components used to build a piece of software and the supply chain relationships between them, often described as an ingredients list. Suppliers produce SBOMs and buyers request them so that, when a vulnerability is disclosed in a component, a team can tell quickly which of its products contain it.

What an SBOM must contain

The National Telecommunications and Information Administration (NTIA) published the first minimum elements on 12 July 2021, as directed by Executive Order 14028. They cover three areas: data fields, automation support, and practices and processes. The baseline fields are supplier, component name, version, other unique identifiers, dependency relationship, author of the SBOM data and timestamp, in formats such as SPDX, CycloneDX or SWID tags.

On 29 July 2026 CISA, the National Security Agency, the FBI and international partners published 2026 Minimum Elements for a Software Bill of Materials, which updates and replaces the NTIA list. It reflects a 2025 public comment period and current tooling while keeping the original principles.

What an SBOM is not

An SBOM is an inventory, not a vulnerability report. The NTIA report notes that SBOM data reflects software at a point in time while vulnerability data keeps changing, and recommends tracking the two separately and linking them. Whether a flaw in a listed component affects the product is a different question, which CISA's SBOM page assigns to the related VEX attestation.

What a patch desk does with it

The payoff comes on disclosure day. When a flaw lands in a common library, a team holding SBOMs searches them for the component and version instead of polling every supplier. Without them, CISA's VEX guidance notes, users tend to contact suppliers directly, loading their support and security teams.

Practical steps: ask suppliers for SBOMs that meet the 2026 minimum elements, store them where the vulnerability team can query them, and pair each component hit with the supplier's VEX status and the KEV catalog before setting a deadline. Identifiers decide whether matching works, so check that component names line up with vulnerability data such as CPE names.

Where it appears on Daily CISO

Must-patch is the daily list of exploited CVEs to check SBOM inventories against. The security glossary defines cybersecurity supply chain risk management, the discipline SBOMs serve, and the weekly archive records advisories week by week since January 2022.

Related terms

Vulnerability Exploitability eXchange (VEX), Common Platform Enumeration (CPE), Common Vulnerabilities and Exposures (CVE) and Known Exploited Vulnerabilities (KEV) catalog.