- The revised baseline was co-authored with the NSA, FBI and 15 international agencies
- It adds 10 data fields, capturing details like the SBOM's author signature
- The baseline applies to open-source code, AI systems and software-as-a-service
The Cybersecurity and Infrastructure Security Agency has published a revised baseline for what a software bill of materials should contain, replacing guidance the National Telecommunications and Information Administration issued in 2021. CISA released the document Wednesday.
The National Security Agency, the FBI and 15 international cybersecurity agencies co-authored the guidance. CISA said it incorporated more than 90 comments received during a public comment period on a draft published last year.
The elements apply to software of every kind, including open-source code, artificial intelligence systems and software-as-a-service.
Software supply chain security is one of the many priorities shaping the Department of Homeland Security's mission. The Potomac Officers Club's 2026 Homeland Security Summit on Nov. 10 will bring together agency leaders and industry executives to examine the cybersecurity and technology challenges facing the homeland security enterprise. Register now!
What Changed in the 2026 SBOM Minimum Elements?
The update adds 10 data fields. Four capture information about the SBOM document itself: an author signature, the tool used to generate the SBOM, the data format and the phase of the software lifecycle at which the SBOM was produced. Three more identify the component being documented through a cryptographic hash value, the algorithm behind that hash and the license the component carries.
Several existing elements were renamed. Supplier name becomes component producer, which the authors said resolves the ambiguity that had built up around software distributors. Author of SBOM data becomes SBOM author, and version of the component becomes component version.
Two changes expand the scope of what an SBOM must cover. The former depth element, which required only top-level dependencies, has become coverage and now requires all components, including transitive dependencies, with no limit on how deep the inventory must reach. Known unknowns becomes explicitly identifying unknown information, and now asks authors to distinguish between data they lack and data they are withholding.
The access control element is gone, folded into distribution and delivery. Software identification tags dropped off the list of accepted data formats, leaving two formats the guidance describes as widely used: System Package Data Exchange, or SPDX, and CycloneDX.
How Does the Guidance Treat AI and Cloud Software?
The minimum elements apply to AI systems and software-as-a-service, but the document adds no fields specific to either. For AI, it points to separate guidance CISA issued in May with the G7 Cybersecurity Working Group, titled Software Bill of Materials for AI – Minimum Elements. Canada, France, Germany, Italy, Japan, the United Kingdom and the European Union took part in that effort, which offered recommendations tailored to AI supply chains.
The authors flagged four areas for further work: cloud software, AI software, validating SBOM accuracy and correlating SBOM data with security advisories such as Vulnerability Exploitability eXchange and the Common Security Advisory Framework.
Chris Butera, CISA's acting executive assistant director for cybersecurity, said the revision reflects how far supply chain security practices have advanced.
“As we continue to see SBOMs adopted more widely, we want the SBOM minimum elements to paint a modern, comprehensive supply chain security picture,” he added.
