A software bill of materials (SBOM) is a machine-readable inventory of the components in a software product and the relationships between them. It helps your team find out whether a newly disclosed vulnerability or licensing issue could affect software you build or use. But an SBOM is an input to security and supply-chain work—not proof that software is safe.
What an SBOM records
The U.S. National Telecommunications and Information Administration (NTIA) defines an SBOM as a formal record of software components and their supply-chain relationships. Think of it as an inventory of ingredients and how they fit together, rather than a security certificate. NTIA’s minimum-element framework calls for seven kinds of data:
As an Amazon Associate I earn from qualifying purchases.
- Supplier of the component
- Component name
- Component version
- Other identifiers that help distinguish the component
- The component’s dependency relationships
- Who created the SBOM data
- When the data was created
Those fields are only part of the framework. It also addresses automation and machine readability, plus the processes for requesting, generating, distributing, and using SBOMs. In other words, having a file is not enough if nobody can ingest it or act on what it contains. NTIA’s minimum-elements report sets out the framework.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why teams use SBOMs
Investigate vulnerabilities faster
When a vulnerability is disclosed, teams can compare the affected component and version with their SBOM records. That can help identify software that may be affected and focus investigation. A match is a lead to investigate, not a finding that the vulnerable code is exploitable in your environment; an absent match is only as reliable as the SBOM’s coverage and accuracy.
#1 Best Overall
Track software and licenses
SBOMs can support broader software inventory and license-management work by making components and their relationships easier to search. NTIA describes SBOM data as a foundation that other security tools and practices can build on, not a replacement for them. NTIA’s explanation of SBOMs discusses these uses and their limits.
Connect supplier information to existing workflows
For applicable federal procurement contexts, NIST guidance discusses machine-readable SBOMs, access to supplier information, repositories, and integration with vulnerability-detection capabilities for automated alerting. This is federal guidance, not a universal legal requirement for every private company or software purchase. Check the rules and contract terms that apply to your organization. NIST Special Publication 800-161 Revision 1, Update 1 treats SBOMs as one element of cybersecurity supply-chain risk management.
Rank #2
What formats should your team accept?
In its 2025 guidance, CISA identifies SPDX and CycloneDX as widely used SBOM formats and recommends accepting interoperable, machine-processable output. NTIA’s 2021 materials also listed SWID tags among acceptable formats at that time. These references describe different publication dates; for a current workflow, assess format support against CISA’s newer guidance and your organization’s ability to ingest the data. CISA’s 2025 minimum-elements guidance explains the formats and generation considerations.
Why generation context matters
An SBOM’s usefulness depends partly on how and when it was produced. CISA’s 2025 guidance describes three contexts:
- Before a build: The record is derived from repository or source information. It can describe intended components, but it is not necessarily a record of everything that ended up in a particular built artifact.
- During a build: The record describes components that contributed to a releasable artifact. This can tie the inventory to the build, depending on the process and its coverage.
- After a build: Binary analysis examines the completed software. It can reveal components in the artifact, but may not recover the exact dependencies used at build time.
NIST specifically cautions that a retroactively generated SBOM may not reproduce the precise build-time dependencies. Ask suppliers how an SBOM was generated, which artifact or release it represents, and what its visibility may omit.
How to make an SBOM useful in practice
- Set scope and timing. Decide which internally developed software, purchased products, and suppliers are in scope, and when an SBOM must be requested or generated.
- Specify usable output. Request machine-readable, interoperable formats such as SPDX or CycloneDX, and confirm that your systems can ingest and manage them.
- Capture provenance. Record how and when the SBOM was produced and which software artifact it describes. Treat source-derived, build-time, and post-build records as different evidence.
- Define operations. Establish how SBOMs are distributed, who may access them, how often they are updated, and how errors are corrected. These are part of NTIA’s operational framework, not optional details after generation.
- Connect records to response. Feed the inventory into vulnerability-management processes so relevant alerts can prompt investigation and prioritization.
- Keep other controls. Continue supplier-risk assessment and other supply-chain security practices; NIST positions SBOMs as complementary inputs, not substitutes.
What an SBOM cannot tell you
An SBOM does not certify that software is secure, free of vulnerabilities, or completely represented. Its value depends on the accuracy, scope, and generation context of the record, as well as whether your team can use the data. NIST advises organizations to retain risk-based supply-chain practices and use SBOMs as one input to them.
Rank #4
Questions to ask when assessing an SBOM workflow
When comparing an internal process or a supplier’s approach, focus on whether the workflow gives you evidence you can actually use:
Recommended Free Tools
- At what stage is the SBOM generated, and which artifact or release does it cover?
- How are components identified, and how much dependency detail is provided?
- Can your systems ingest the formats the supplier provides?
- Where are SBOMs stored, who can access them, and how are revisions distributed?
- How frequently are they updated, and how are inaccuracies corrected?
- Can the inventory connect to vulnerability alerts and your investigation process?
These questions follow the generation, interoperability, repository, and monitoring considerations in CISA’s guidance and NIST’s supply-chain guidance; they are evaluation criteria, not a ranking of products.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
