SBOM Guide
Why SBOMs matter
Section titled “Why SBOMs matter”Modern applications are built using third-party components, creating complex software supply chains. While this approach has positive effects, it also raises new challenges, for example in the areas of compliance and cybersecurity. Here, the main challenge often lies not in solving the actual problem, but first in identifying which dependencies are used directly or indirectly within a software.
To create the needed transparency, the tech industry started to adopt software bills of materials (SBOM). Just as Bill of Materials (BOM) known from traditional manufacturing, SBOMs aim to list components within a software project in a standardized and machine-readable manner, enabling automated analysis. This website provides information, best practices, and guidelines on SBOMs to further increase their adoption.
SBOM basics
Section titled “SBOM basics”The term “SBOM” refers to a concept implemented primarily through the CycloneDX and SPDX standards.
SBOMs can be generated at different stages of the software development lifecycle, and the most useful form depends on the intended use case.
Learn the Basics of SBOMs
Use cases
Section titled “Use cases”SBOMs support several important activities, but their value depends on the quality and limitations of the generation and analysis tooling in use.
Stakeholder roles
Section titled “Stakeholder roles”Generating an SBOM is only the first step. Its value emerges through the lifecycle of production, distribution, and consumption, where different actors create, transfer, validate, and use SBOM data.