Software Bills of Materials

A software bill of materials, or SBOM, is a formal record of the components in software and their supply chain relationships. Think of it as an inventory tied to a specific product or release. It names what is present and how the parts connect.

That inventory gives software producers, buyers, and operators a shared source of component data. A producer can document what it ships. A buyer can include transparency in acquisition. An operator can ask which products contain a component when new risk information appears.

An SBOM is data, not a security verdict. You gain value when a system consumes the data and connects it to vulnerability advisories, license information, end-of-support data, and internal asset records.

The mental model: a release inventory

Start with the subject. The subject is the product, artifact, or release described by the SBOM. Components sit beneath that subject. Relationships connect direct and transitive components into a dependency graph.

Each component needs stable identity data. Useful records include a component name and version, its supplier or producer, identifiers, hashes, and license information. The SBOM also records document metadata such as its author, creation time, and generation tool.