US and Allied Governments Release Updated SBOM Guidance

Updated SBOM Minimum Elements

Government agencies in the US and 13 allied countries have released updated guidance on the minimum elements required for a Software Bill of Materials (SBOM). This document builds upon the SBOM Minimum Elements guidance initially released by the NTIA in 2021 and incorporates feedback received during a public consultation period last year.

Purpose and Impact

The updated guidance aims to reflect changes in supply chain security and software transparency. SBOMs are intended to serve as a foundational component for software security and supply chain risk management, enabling organizations to create accurate inventories of software and its components within their environments. Increased visibility into the software supply chain can inform risk management decisions, including addressing known and newly discovered vulnerabilities.

Key Changes and Additions

The updated document maintains the core principles of the 2021 guidance while addressing current SBOM requirements. It introduces new elements such as Component Hash Algorithm, Component Hash Value, Component License, Author Signature, Data Format Name, Data Format Version, Generation Context, Tool Name, Tool Version, and SBOM Version. Two elements, Access Control and Software Identification (SWID) Tags, were removed, while others were replaced, clarified, or modified to improve data mapping and quality.

Evolving SBOM Landscape

The agencies note that SBOM tooling has advanced significantly, driven by a growing number of organizations generating, sharing, consuming, and analyzing SBOMs. These advancements allow organizations requesting SBOMs to demand more detailed information about their supply chain and software components than was possible in 2021. While the document applies broadly to all software, specific types like AI systems and SaaS may require additional elements.