# What is a Software Bill of Materials (SBOM)?

> A software bill of materials is a formal record of the software components and supply-chain relationships associated with a defined product, package, or artifact.

- Canonical URL: https://yellowcube.eu/glossary/software-bill-of-materials/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It can identify first-party and third-party components, versions, suppliers, unique identifiers, dependency relationships, and information about when and how the record was created.

An SBOM gives producers and consumers a shared inventory for questions such as whether a component is present, which products may be affected by new information, and where license or maintenance review is needed. Machine-readable standards such as SPDX and CycloneDX make this information easier to exchange and automate. The SBOM must still be tied to a specific release or artifact and kept current as the software changes.

### Key points

- **Core information:** SBOM author, software producer, component names and versions, identifiers and hashes, licenses, dependency relationships, generation tool and context, timestamp, and declared coverage.
- **Operational uses:** Component discovery, vulnerability investigation, license review, supplier communication, asset correlation, and comparison between software releases.
- **Quality controls:** Generate near the authoritative build, include transitive and embedded components, state known completeness limits, validate identifiers, protect integrity, and define sharing rules.
- **Important limitation:** An SBOM is an inventory, not a vulnerability or exploitability verdict. It may show that a component is present without showing whether affected code is reachable, configured, or mitigated.

### Related terms

[Software composition analysis (SCA)](<https://yellowcube.eu/glossary/software-composition-analysis/>) · [Supply-chain security](<https://yellowcube.eu/glossary/supply-chain-security/>)

### Sources

[CISA 2025 Minimum Elements for an SBOM — public comment draft](https://www.cisa.gov/sites/default/files/2025-08/2025_CISA_SBOM_Minimum_Elements.pdf) · [NTIA 2021 Minimum Elements for an SBOM](https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom) · [SPDX specifications](https://spdx.dev/use/specifications/) · [CycloneDX specification overview](https://cyclonedx.org/specification/overview/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.