{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"platform/sbom","url":{"en":"https://atlas.maintz.dev/en/terms/platform/sbom/","da":"https://atlas.maintz.dev/da/terms/platform/sbom/"},"term":{"en":"Software bill of materials (SBOM)","da":"Softwarestykliste (SBOM)"},"aka":{"en":["SBOM"],"da":["SBOM"]},"domain":["platform","security"],"cluster":"delivery","layer":"delivery","status":"current","era":2018,"summary":{"en":"A list of every component and outside library a piece of software contains, so its owners know exactly what is inside it.","da":"En liste over alle komponenter og eksterne biblioteker, et stykke software indeholder, så man ved præcis, hvad det består af."},"body":{"formal":{"en":"A record in a format machines can read that lists the parts of a software product, giving at least each part's supplier, name, version and unique ID, how the parts depend on each other, and who made the record and when.","da":"En liste i et format, som maskiner kan læse, over delene i et softwareprodukt med mindst hver dels leverandør, navn, version og et unikt ID, hvordan delene afhænger af hinanden, og hvem der lavede listen og hvornår."},"plain":{"en":"Like the parts list that comes with a car; when a maker recalls a faulty brake part, every owner can quickly check whether their car has it.","da":"Som reservedelslisten til en bil; når en producent tilbagekalder en defekt bremsedel, kan alle ejere hurtigt tjekke, om deres bil har den."},"inPractice":{"en":"When the Danish Resilience Agency warns of a serious flaw in a widely used logging library, a region's security team searches its SBOMs and within an hour finds the eleven hospital systems that use the affected version.","da":"Da SAMSIK advarer om en alvorlig sårbarhed i et udbredt bibliotek til logs, søger regionens sikkerhedsteam i sine SBOM'er og finder inden for en time de elleve hospitalssystemer, der bruger den ramte version."},"whyItMatters":{"en":"Nobody can fix what they do not know they have; US federal rules have asked software suppliers for SBOMs since 2021, and the Cyber Resilience Act requires makers of products sold in the EU to draw one up.","da":"Man kan ikke rette det, man ikke ved, man har; amerikanske statslige regler har siden 2021 bedt softwareleverandører om SBOM'er, og Cyberrobusthedsforordningen kræver, at producenter af produkter, der sælges i EU, udarbejder en."}},"deepDive":{"en":"The modern SBOM effort began with the US NTIA multistakeholder process in 2018 and was given regulatory weight by Executive Order 14028 (May 2021), after which NTIA published The Minimum Elements for an SBOM (July 2021). It defines three groups: data fields (supplier name, component name, version, other unique identifiers, dependency relationship, author of the SBOM data and timestamp), automation support (a machine-readable format - SPDX, CycloneDX or SWID tags), and practices and processes (frequency of regeneration, depth, handling of known unknowns, distribution and access control).\n\nTwo formats dominate. SPDX, from the Linux Foundation, was standardised as ISO/IEC 5962:2021 (SPDX 2.2.1); SPDX 3.0 (2024) restructured the model into profiles for security, licensing, AI and datasets. CycloneDX, from OWASP, is standardised by Ecma as ECMA-424 (first edition June 2024, second edition December 2025) and also covers services, hardware, machine-learning models (ML-BOM), cryptographic assets (CBOM) and embedded vulnerability or VEX data. Components are identified by Package URLs (purl, e.g. pkg:npm/lodash@4.17.21) and sometimes CPE names; accurate identifiers are what make automated vulnerability matching possible, and inconsistent CPEs are a common cause of both false positives and misses.\n\nSBOMs differ by when they are produced; CISA's taxonomy distinguishes design, source, build, analysed, deployed and runtime SBOMs. A build SBOM generated by the package manager or build tool during compilation is usually the most complete; an analysed SBOM produced by scanning a finished binary or container image (Syft, Trivy, cdxgen) can miss statically linked, vendored or shaded code. Depth matters: many dependencies are transitive, and an SBOM listing only direct dependencies would have hidden most Log4j exposure in 2021. SBOMs are commonly attached to releases or container images as signed in-toto attestations so recipients can verify their origin.\n\nAn SBOM is an inventory, not an assessment. Its value appears when it is ingested into tooling (for example OWASP Dependency-Track) and continuously correlated with vulnerability data, and when paired with VEX (Vulnerability Exploitability eXchange, in CSAF or OpenVEX form), in which the supplier states whether a listed vulnerability actually affects the product. In the EU, the Cyber Resilience Act (Regulation (EU) 2024/2847), Annex I Part II point 1, requires manufacturers to identify and document components, including by drawing up an SBOM in a commonly used, machine-readable format covering at the very least the top-level dependencies; the SBOM belongs to the technical documentation and need not be published. The CRA's main obligations apply from 11 December 2027, while its vulnerability-reporting duties have applied since 11 September 2026. SBOM differs from software composition analysis, which is the process that consumes or produces such inventories to find vulnerable and non-compliant components.","da":"Det moderne SBOM-arbejde begyndte med den amerikanske NTIA's multistakeholder-proces i 2018 og fik regulatorisk vægt med Executive Order 14028 (maj 2021), hvorefter NTIA udgav The Minimum Elements for an SBOM (juli 2021). Den definerer tre grupper: datafelter (leverandørnavn, komponentnavn, version, andre unikke identifikatorer, afhængighedsforhold, forfatter til SBOM-data og tidsstempel), understøttelse af automatisering (et maskinlæsbart format - SPDX, CycloneDX eller SWID-tags) samt praksis og processer (hvor ofte den gendannes, dybde, håndtering af kendte ubekendte, distribution og adgangskontrol).\n\nTo formater dominerer. SPDX fra Linux Foundation blev standardiseret som ISO/IEC 5962:2021 (SPDX 2.2.1); SPDX 3.0 (2024) omstrukturerede modellen i profiler for sikkerhed, licenser, AI og datasæt. CycloneDX fra OWASP er standardiseret af Ecma som ECMA-424 (første udgave juni 2024, anden udgave december 2025) og dækker også tjenester, hardware, maskinlæringsmodeller (ML-BOM), kryptografiske aktiver (CBOM) og indlejrede sårbarheds- eller VEX-data. Komponenter identificeres med Package URLs (purl, fx pkg:npm/lodash@4.17.21) og undertiden CPE-navne; præcise identifikatorer er det, der gør automatisk matchning af sårbarheder mulig, og inkonsistente CPE'er er en almindelig årsag til både falske positiver og oversete fund.\n\nSBOM'er adskiller sig efter, hvornår de laves; CISA's taksonomi skelner mellem design-, kilde-, build-, analyserede, udrullede og runtime-SBOM'er. En build-SBOM, som pakkehåndteringen eller byggeværktøjet genererer under kompileringen, er som regel den mest komplette; en analyseret SBOM, lavet ved at scanne en færdig binær eller et container-image (Syft, Trivy, cdxgen), kan overse statisk linket, vendoreret eller shadet kode. Dybden betyder noget: mange afhængigheder er transitive, og en SBOM med kun direkte afhængigheder ville have skjult det meste af Log4j-eksponeringen i 2021. SBOM'er vedhæftes ofte udgivelser eller container-images som signerede in-toto-attestationer, så modtagerne kan verificere deres oprindelse.\n\nEn SBOM er en fortegnelse, ikke en vurdering. Værdien viser sig, når den indlæses i værktøjer (fx OWASP Dependency-Track) og løbende sammenholdes med sårbarhedsdata, og når den kombineres med VEX (Vulnerability Exploitability eXchange i CSAF- eller OpenVEX-form), hvor leverandøren oplyser, om en listet sårbarhed faktisk rammer produktet. I EU kræver Cyberrobusthedsforordningen (forordning (EU) 2024/2847), bilag I, del II, punkt 1, at producenter identificerer og dokumenterer komponenter, bl.a. ved at udarbejde en SBOM i et almindeligt anvendt, maskinlæsbart format, der som minimum dækker de øverste afhængigheder; SBOM'en er en del af den tekniske dokumentation og skal ikke offentliggøres. Forordningens hovedforpligtelser gælder fra 11. december 2027, mens pligten til at indberette sårbarheder har gældt siden 11. september 2026. SBOM adskiller sig fra software composition analysis, som er den proces, der bruger eller producerer sådanne fortegnelser for at finde sårbare og ikke-kompatible komponenter."},"howTo":{"steps":{"en":["Decide which products and releases need an SBOM, including products placed on the EU market under the Cyber Resilience Act, and choose one format, SPDX or CycloneDX.","Generate a build SBOM automatically in the pipeline for every release from the package manager or build tool, and add an analysed SBOM of the finished image to catch operating-system packages.","Check that each SBOM holds the minimum data - supplier, component name, version, unique identifiers such as a purl, dependency relationships, author and timestamp - and that it includes transitive dependencies.","Sign the SBOM and attach it to the release or container image as an attestation, and keep it with the product's technical documentation.","Load all SBOMs into a tool such as OWASP Dependency-Track that continuously matches components against newly published vulnerabilities.","Publish VEX statements saying whether a listed vulnerability actually affects your product, so customers do not chase false alarms.","Require SBOMs from your own suppliers in contracts, and load the SBOMs you receive into the same inventory.","Regenerate the SBOM for every new release, and use the inventory to answer \"are we affected?\" within hours when a critical flaw is announced."],"da":["Beslut, hvilke produkter og udgivelser der skal have en SBOM, herunder produkter, der bringes i omsætning i EU under Cyberrobusthedsforordningen, og vælg ét format, SPDX eller CycloneDX.","Generér automatisk en build-SBOM i pipelinen for hver udgivelse ud fra pakkehåndteringen eller byggeværktøjet, og tilføj en analyseret SBOM af det færdige image for at fange styresystempakker.","Tjek, at hver SBOM har minimumsdata - leverandør, komponentnavn, version, unikke identifikatorer som en purl, afhængighedsforhold, forfatter og tidsstempel - og at den medtager transitive afhængigheder.","Signér SBOM'en, og vedhæft den udgivelsen eller container-imaget som en attestation, og opbevar den sammen med produktets tekniske dokumentation.","Indlæs alle SBOM'er i et værktøj som OWASP Dependency-Track, der løbende matcher komponenterne mod nyudgivne sårbarheder.","Udgiv VEX-erklæringer om, hvorvidt en listet sårbarhed faktisk rammer jeres produkt, så kunderne ikke jagter falske alarmer.","Kræv SBOM'er af jeres egne leverandører i kontrakterne, og indlæs dem, I modtager, i samme fortegnelse.","Generér SBOM'en igen ved hver ny udgivelse, og brug fortegnelsen til at svare på \"er vi ramt?\" inden for timer, når en kritisk sårbarhed bliver kendt."]},"pitfalls":{"en":["Producing SBOMs only to tick a box and never loading them into a tool that checks them against new vulnerabilities.","Listing only direct dependencies, which hides most of the real exposure, as with Log4j in 2021.","Making the SBOM by hand once instead of on every build, so it no longer matches what is shipped.","Using inconsistent component identifiers, so automatic matching gives both false positives and missed vulnerabilities."],"da":["At lave SBOM'er for at opfylde et krav uden nogensinde at indlæse dem i et værktøj, der tjekker dem mod nye sårbarheder.","Kun at liste direkte afhængigheder, hvilket skjuler det meste af den reelle eksponering, som med Log4j i 2021.","At lave SBOM'en i hånden én gang i stedet for ved hvert build, så den ikke længere passer med det, der leveres.","At bruge inkonsistente identifikatorer for komponenter, så den automatiske matchning giver både falske positiver og oversete sårbarheder."]},"guides":[{"title":"2026 Minimum Elements for a Software Bill of Materials (SBOM)","url":"https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom","publisher":"CISA","tier":"official-doc"},{"title":"Software Bill of Materials (SBOM)","url":"https://www.cisa.gov/sbom","publisher":"CISA","tier":"official-doc"},{"title":"OWASP Dependency-Track documentation","url":"https://docs.dependencytrack.org/","publisher":"OWASP","tier":"reference"},{"title":"NIST SP 800-218 - Secure Software Development Framework (SSDF) Version 1.1","url":"https://csrc.nist.gov/pubs/sp/800/218/final","publisher":"NIST","tier":"standard"}]},"edges":[{"type":"requires","to":"platform/software-supply-chain","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/supply-chain-attack","why":{"en":"A list of every component in a product lets a team find a compromised or flawed one quickly.","da":"En liste over alle komponenter i et produkt lader et team hurtigt finde en kompromitteret eller fejlbehæftet del."},"confidence":"medium","strength":"normal"},{"type":"mitigates","to":"ai/ai-supply-chain-attack","why":{"en":"Listing every model, dataset and library a system uses lets a team find and replace a tampered part quickly.","da":"En liste over alle modeller, datasæt og biblioteker, et system bruger, lader et team hurtigt finde og udskifte en manipuleret del."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"platform/software-composition-analysis","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/supplier-management","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/vulnerability-scanning","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"The Minimum Elements For a Software Bill of Materials (SBOM)","url":"https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom","tier":"standard","publisher":"NTIA, US Department of Commerce"},{"title":"Regulation (EU) 2024/2847 - Cyber Resilience Act, Annex I","url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj","tier":"standard","publisher":"European Union"},{"title":"NIST SP 800-218 - Secure Software Development Framework (SSDF)","url":"https://csrc.nist.gov/pubs/sp/800/218/final","tier":"standard","publisher":"NIST"},{"title":"ECMA-424 - CycloneDX Bill of Materials Specification","url":"https://ecma-international.org/publications-and-standards/standards/ecma-424/","tier":"standard","publisher":"Ecma International"}],"draft":true}