Software Bill of Materials (SBOM)

A Software Bill of Materials, or SBOM, lists components used to build or deliver software, including third-party libraries and dependencies. Its purpose is to improve visibility into what a product contains so organizations can investigate vulnerabilities, licensing questions, and changes in their software supply chain.

An SBOM is useful when a website relies on numerous packages, frameworks, and hosted application components. If a security advisory affects a particular dependency, an accurate inventory helps maintainers identify where it appears. SBOM formats may include SPDX or CycloneDX, and the practical value depends on completeness, accuracy, and timely updates.

The inventory is not a security audit. A listed dependency does not prove the presence of an exploitable vulnerability, and a product with an SBOM may still contain insecure code or misconfigurations. Teams need vulnerability intelligence, remediation procedures, and ways to connect the inventory with what was actually deployed.

For agencies, requesting an SBOM may be appropriate for custom applications or higher-risk vendors; a simple brochure site does not necessarily need the same procurement process as a complex SaaS platform. CISA published updated minimum-elements guidance in 2025.