What Is an SBOM (Software Bill of Materials)?

An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of the components that make up a piece of software: open-source and third-party libraries, their versions, their suppliers, and how they depend on one another. It is to software what an ingredients list is to packaged food.

What an SBOM contains

In the U.S., the reference point is the NTIA's "The Minimum Elements for a Software Bill of Materials" (July 2021), written under Executive Order 14028. It lists seven baseline data fields for each component: supplier name, component name, version, other unique identifiers (such as a package URL), dependency relationship, author of the SBOM data, and timestamp.

Two formats dominate:

• SPDX, a Linux Foundation project published as the international standard ISO/IEC 5962:2021.
• CycloneDX, an OWASP project standardised by Ecma International as ECMA-424.

Both can be generated automatically from lockfiles and build output. An SBOM on its own does not tell you whether anything in it is vulnerable; for that, each component has to be matched against a vulnerability database. SBOMs also go stale as soon as dependencies change.

In the EU, the Cyber Resilience Act requires manufacturers of products with digital elements to draw up an SBOM. It must be in a commonly used, machine-readable format and cover at least the top-level dependencies.

How GeekWala uses SBOMs

GeekWala imports CycloneDX and SPDX JSON SBOMs and scans the components they list for known vulnerabilities, enriched with EPSS and CISA KEV, the same pipeline used for a lockfile-based scan. It also offers a free SBOM Generator (/tools/sbom-generator) for creating one from a manifest, and a free SBOM Validator (/tools/sbom-validator) for checking that a document you received meets the format's required fields before you rely on it.

Sources: NTIA — Minimum Elements for an SBOM · SPDX · CycloneDX

Related terms

• VEX (Vulnerability Exploitability eXchange)
• CVSS (Common Vulnerability Scoring System)
• EPSS (Exploit Prediction Scoring System)

Read the full guide · What dependency vulnerability scanning is · Back to the glossary

Last updated September 14, 2026