A Software Bill of Materials (SBOM) describes, in a structured and machine-readable format, the open-source and proprietary components that constitute a software product, including their licenses, versions, vendors, vulnerabilities, and dependency relationships. SBOMs enable practitioners to gain visibility into the software supply chain and monitor any risks associated with software security, licensing, and more.

Public administrations have been promoting SBOMs to have secure and accountable software products. For example, in 2021, the United States Government, per President Biden’s Executive Order 14028, laid down that any organization releasing software products to federal agencies must provide SBOMs for the released software products. Moreover, in 2022, the European Commission proposed a cybersecurity regulation (namely, Cyber Resilience Act) outlining that software producers must document the vulnerabilities and components of their software products with SBOMs. As a result, SBOMs are expected to shortly become the de-facto standard for any organization that develops or maintains software products in both industrial and open-source contexts.

{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "components": [
    {
      "type": "library",
      "group": "org.example",
      "name": "mylibrary",
      "version": "1.0.0",
      "cpe": "cpe:/a:example:mylibrary:1.0.0",
      "purl": "pkg:maven/org.example/mylibrary@1.0.0",
      "externalReferences": [
        {
          "type": "advisories",
          "url": "https://example.org/security/advisories.json"
        }
      ]
    }
  ]
}
                

Example illustrating a component (specifically, a library) in an SBOM, according to the CycloneDX standard and the JSON format (source).