SBOM (software bill of materials)
SBOM · software bill of materials · component inventory · CycloneDX · SPDX · nomenclature logicielle
A detailed, machine-readable list of every component in a piece of software (libraries, versions, suppliers, licences), much like the ingredients list on a food product.
In practice
Two formats dominate: CycloneDX, an OWASP project standardised by Ecma International (ECMA-424), and SPDX, backed by the Linux Foundation and published as the ISO/IEC 5962:2021 standard. Generated automatically at build time, an SBOM lets you answer “are we affected by this new flaw?” in minutes rather than weeks. The Cyber Resilience Act requires manufacturers to draw one up, covering at least the top-level dependencies, in a commonly used, machine-readable format (Annex I); it does not have to be published, but must be provided to market surveillance authorities on a reasoned request.
Fictional case inspired by Log4Shell (CVE-2021-44228, December 2021): vendor A queries its SBOMs and knows within twenty minutes that three of its products ship the vulnerable library; vendor B, with no inventory, spends two weeks digging through its repositories.
How to protect yourself
- Generate the SBOM automatically for every release, in the CI/CD pipeline.
- Match it continuously against new CVEs.
- Require an SBOM from your software suppliers.
