Software Bills of Materials
A software bill of materials is a machine-readable inventory of the components and relationships in a software product. It helps producers and users understand what a release contains so they can manage security, licensing, and operational risk.
itSoftware supply chain security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Software Bills of Materials
Software Bills of Materials is the subject of this course. A software bill of materials, or SBOM, is a formal record of the components in software and their supply chain relationships. Think of it as an inventory tied to a specific product or release.
The useful unit of work is a closed loop: clarify the goal and boundaries, gather the inputs the practice requires, make the decision or change, record evidence, and return with owners for the next cycle. Skipping any link leaves teams busy without durable results.
Tooling supports the loop; it does not replace it. Choose tools after the boundary and evidence model are clear. Comparing products without that model produces feature matrices that do not change how the work runs.
Common failure modes include undefined ownership, metrics that count activity instead of outcomes, and irreversible steps taken without a review path. Treat those as design defects in the practice, not as individual heroics to compensate later.
Operators should be able to explain which signals would change a decision this week. If no signal can change the plan, the practice has become ritual. Keep the feedback path short enough that evidence still influences the next cycle.
Name the owners for each stage of the loop before the work scales. Unowned stages become permanent exceptions. Record decisions with enough context that a future operator can tell why a tradeoff was accepted. Prefer fewer, sharper metrics that change behavior over broad dashboards that only describe activity after the fact.
Read the Intro for the core model. Use the Cheatsheet when you need the operating map. Updates tracks official guidance when this course configures an update source; otherwise the practice is settled without a live feed.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.cisa.gov/sites/default/files/2025-08/2025_CISA_SBOM_Minimum_Elements.pdf
Supports
- SBOM definition and value to software producers, choosers, and operators
- Component and document data, including names, versions, identifiers, hashes, licenses, authors, timestamps, tools, and generation context
- Automation, dependency relationships, coverage, known unknowns, updates, distribution, and delivery
- https://www.cisa.gov/sites/default/files/2025-09/joint-guidance-a-shared-vision-of-software-bill-of-materials-for-cybersecurity_508c.pdf
Supports
- Need to consume SBOM data and convert it into insights that drive action
- Correlation with vulnerability, advisory, project, supply chain risk, and end-of-support data
- Concurrent use of SBOM and VEX data
- https://www.cisa.gov/sites/default/files/2024-08/SECURING_THE_SOFTWARE_SUPPLY_CHAIN_RECOMMENDED_PRACTICES_FOR_SOFTWARE_BILL_OF_MATERIALS_CONSUMPTION-508.pdf
Supports
- Enterprise ingestion, correlation, risk analysis, and operational use of SBOM data
- VEX as an assertion about whether a product is affected by a known vulnerability
- An SBOM alone requires consumption capabilities to drive security actions
- https://www.cisa.gov/sites/default/files/2023-04/minimum-requirements-for-vex-508c.pdf
Supports
- VEX as machine-readable product or component status with respect to a vulnerability
- VEX integration with SBOMs, vulnerability databases, and security advisories
- https://spdx.dev/use/specifications/
Supports
- SPDX as an international open standard under ISO/IEC 5962:2021
- Current SPDX specification index and supported historical versions
- https://cyclonedx.org/specification/overview/
Supports
- CycloneDX object model for components, services, dependencies, relationships, and metadata
- Supported JSON, XML, and Protocol Buffers serializations
- Direct and transitive dependency graph representation
- https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-SBOM-en.pdf
Supports
- CycloneDX SBOM production, validation, distribution, and consumption guidance
- Distinction between valid structure and useful, complete content
- Digital signatures as integrity and authenticity evidence rather than proof of inventory completeness
- https://github.com/sindresorhus/awesome
Supports
- Starting index used to discover relevant curated awesome lists
- https://github.com/bureado/awesome-software-supply-chain-security
Supports
- Discovery of the dedicated awesome-sbom list and SBOM ecosystem tools
- Discovery of Syft and Dependency-Track as relevant SBOM projects
- https://github.com/awesomeSBOM/awesome-sbom
Supports
- Curated discovery of Syft, Dependency-Track, Trivy, and OSV-Scanner
- Tool capability categories for SBOM production, analysis, viewing, and related operations
- https://oss.anchore.com/docs/reference/syft/cli/
Supports
- Syft generation from container images and filesystems
- CycloneDX and SPDX output formats
- https://dependencytrack.org/
Supports
- CycloneDX SBOM ingestion and component analysis
- Vulnerability, operational, and license risk evaluation
- https://trivy.dev/docs/latest/target/sbom/
Supports
- CycloneDX and SPDX SBOM input
- Vulnerability and license scanning
- Generator-specific metadata caveat
- https://google.github.io/osv-scanner/output/
Supports
- Package vulnerability output and source reporting
- SPDX and CycloneDX output options
