Software Bill of Materials (SBOM).

A formal, machine-readable inventory of the components, libraries, and dependencies that make up a piece of software, along with their versions and relationships. It belongs to the Application Security category of cybersecurity.

A formal, machine-readable inventory of the components, libraries, and dependencies that make up a piece of software, along with their versions and relationships.

An SBOM is to software what an ingredient list is to a packaged food. It enumerates open-source and proprietary components, transitive dependencies, versions, suppliers, licenses, and often cryptographic hashes. Common standards include CycloneDX, SPDX, and SWID. SBOMs enable vulnerability management (mapping CVEs and KEVs to deployed software), license compliance, incident response (rapidly answering "are we affected by Log4Shell?"), and procurement due diligence. Regulators - notably US Executive Order 14028, the EU Cyber Resilience Act, and ENISA guidance - increasingly require SBOMs for software supplied to government or critical-sector buyers. Modern programs generate SBOMs automatically in CI/CD and sign or attest them alongside builds.

Defences for Software Bill of Materials (SBOM) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: SBOM.