SBOM
Software Bill of Materials
What a definition is not
A definition is SPEQ’s plain-language decode of how a term is used in practice, cited to the documents that define it. It is a practitioner reference, not legal or regulatory advice, it does not replace the definition in the source, and where a regulator’s wording differs the regulator’s wording governs.
A Software Bill of Materials is a structured, machine-readable inventory of the software components — including third-party, open-source, and off-the-shelf elements — that make up a device’s software. It gives manufacturers and regulators visibility into what is inside the software so vulnerabilities in any component can be identified and managed.
The SBOM is central to device cybersecurity: when a new vulnerability is disclosed in a common library, an SBOM lets a manufacturer immediately determine which products are affected and prioritize response, rather than manually auditing source. It typically lists component names, versions, suppliers, and dependency relationships.
US law now expects an SBOM as part of premarket submissions for cyber devices, and common formats (e.g. SPDX, CycloneDX) make the inventory portable across the supply chain. The SBOM directly supports SOUP management and post-market vulnerability monitoring.
- —Machine-readable inventory of all software components and dependencies.
- —Lets manufacturers map new vulnerabilities to affected products.
- —Expected in premarket submissions for cyber devices under FD&C Act §524B.
- —Common formats include SPDX and CycloneDX.
FDA premarket cybersecurity guidance (SBOM expectations); FD&C Act §524B; NTIA minimum elements for a Software Bill of Materials (2021).
Frequently asked questions
What does SBOM stand for?
SBOM stands for Software Bill of Materials.
What is SBOM?
A Software Bill of Materials is a structured, machine-readable inventory of the software components — including third-party, open-source, and off-the-shelf elements — that make up a device’s software. It gives manufacturers and regulators visibility into what is inside the software so vulnerabilities in any component can be identified and managed.
Which regulations cover SBOM?
FDA premarket cybersecurity guidance (SBOM expectations); FD&C Act §524B; NTIA minimum elements for a Software Bill of Materials (2021).