CISA, U.S. Government and International Partners Release Updated Minimum Elements for a Software Bill of Materials

Today, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and international partners released joint guidance2026 Minimum Elements for a Software Bill of Materials (SBOM). An SBOM is a formal record that serves as an “ingredients list” for software. Organizations can use SBOM data to better understand the makeup of their software components and supply chains, enabling them to make more risk-informed decisions. Minimum elements are the baseline technologies and practices that an SBOM should include.

This joint guidance builds on the National Telecommunications and Information Administration’s (NTIA) Minimum Elements for SBOM published in 2021 and reflects lessons learned and advancements in SBOM tooling driven by the growing number of organizations generating, sharing, consuming, and analyzing SBOMs worldwide. It also incorporates extensive feedback from a 2025 public comment period.

What’s New:

• Refined baseline SBOM data fields, including new requirements for Component Hash, License, SBOM Tool Name, and SBOM Generation Context;
• Enhanced practices for documenting and sharing software components;
• Updated guidance for all software types, including open source, artificial intelligence (AI), and software-as-service (SaaS); and
• Emphasis on machine-processable SBOM formats for scalable risk management.

While the minimum elements for an SBOM apply to all software, some software types—such as AI and SaaS in cloud environments—may require additional elements. Any effort to improve software transparency, regardless of the software type, should begin with the application of the SBOM minimum elements. Read the updated guidance to learn more.

Visit CISA’s SBOM page for additional resources.

Please share your thoughts with us through this anonymous survey. We appreciate your feedback.

This product is provided subject to this Notification and this Privacy & Use policy.