Software Bill Of Materials (SBOM).

What is an SBOM?

SBOM stands for software bill of materials. CISA defines it as a nested inventory, a list of ingredients that make up software components. NIST defines it as a formal record containing the details and supply chain relationships of various components used in building software.

Think of the ingredients list on food packaging. An SBOM lists what is inside a piece of software, so that the buyer or user can see what it is made of. This is a simple illustration.

How does an SBOM work?

NIST notes that software developers and vendors often create products by assembling existing open-source and commercial software components. The SBOM records those component details for the final product. The word nested in CISA’s definition means a component can itself contain other components, and the list can show that.

The supply chain relationships in the NIST definition matter here. They record how the parts connect to the finished product.

Why does it matter?

CISA calls the SBOM a key building block in software security and software supply chain risk management. It promotes it as a transparency tool. When a flaw is announced in a component, an inventory can help a team check whether that component is in the software it uses. This is cautious reasoning from the definition. It also means the list is only as useful as it is complete and up to date.

How can you use SBOMs to reduce risk?

An SBOM is a record, so the value comes from how it is used. These are general ideas that follow from the definitions.

• Ask suppliers for an SBOM for the software you buy, where it is available.
• Keep SBOMs for the software you build, so you know which components you ship.
• Compare the component list with new vulnerability announcements, such as CVE entries.
• Update the record when components change.

These are general habits and not a complete program.

Is an SBOM the same as a vulnerability scan?

No. An SBOM lists components. A vulnerability scan looks for known flaws. The two can work together, because a component list tells you what to check, but the list itself does not say whether any component is vulnerable.

Is an SBOM the same as protection from supply chain attacks?

No. CISA presents the SBOM as a transparency tool and a building block, not a full defense. It helps you see what is in your software. It does not stop a poisoned component from being added. Related terms are supply chain attack and third-party risk.

Related pages in the Knowledge Hub

• Supply chain and vendor risk

Sources

• CISA: CISA defines an SBOM as a nested inventory, a list of ingredients that make up software components, and calls it a key building block in software security and….
• NIST: NIST defines an SBOM as a formal record containing the details and supply chain relationships of various components used in building software; developers and vendors….