Skip to content

References & Resources

This page contains a curated list of external resources to help you on your SBOM journey.

Official Standards

Section titled “Official Standards”

SPDX (Software Package Data Exchange)

The official website for the SPDX standard. Visit website

CycloneDX

The official website for the CycloneDX standard. Visit website

Government Initiatives

Section titled “Government Initiatives”

NTIA: Software Bill of Materials

The website of the US National Telecommunications and Information Administration (NTIA) on SBOMs. Visit website

CISA: Software Bill of Materials

The website of the US Cybersecurity and Infrastructure Security Agency (CISA) on SBOMs. Visit website

Industry Frameworks

Section titled “Industry Frameworks”

FIRST: SBOM and CSAF/VEX Operational Framework

A comprehensive guide by FIRST on implementing SBOM and CSAF/VEX practices, covering the relationship between static SBOMs and dynamic vulnerability data. Download PDF

CISA: SBOM Sharing Primer

CISA’s guide on SBOM sharing roles (Producer, Distributor, Consumer), sharing mechanisms, and best practices for SBOM distribution. Download PDF

CISA: Types of SBOMs

Defines the six types of SBOMs (Design, Source, Build, Analyzed, Deployed, Runtime) and their appropriate use across the software lifecycle. Download PDF

CSAF: Common Security Advisory Framework

The OASIS standard for machine-readable security advisories, including VEX profiles for communicating vulnerability exploitability status. View specification

Community Resources

Section titled “Community Resources”

OWASP SCVS

The OWASP Software Component Verification Standard (SCVS) is a community-driven effort to establish a framework for verifying the security of software components. Visit website

SLSA

Supply-chain Levels for Software Artifacts (SLSA) is a security framework, a checklist of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure. Visit website

OpenChain Project

The OpenChain Project identifies key requirements of a quality open source compliance program to build trust in the open source supply chain. Visit website

Works Cited

Section titled “Works Cited”

Numbered citations referenced by superscript links from individual pages across the site.

  1. OASIS CSAF Technical Committee, “Common Security Advisory Framework (CSAF) Version 2.0,” OASIS Open
  2. CycloneDX, “Vulnerability Exploitability eXchange (VEX),” OWASP CycloneDX
  3. OpenVEX Project, “OpenVEX Specification,” OpenSSF / OpenVEX
  4. CISA, “Minimum Requirements for Vulnerability Exploitability eXchange (VEX),” Cybersecurity and Infrastructure Security Agency (2023)
  5. FDA, “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions,” U.S. Food and Drug Administration
  6. European Parliament and Council, Regulation (EU) 2024/2847 — Cyber Resilience Act, Official Journal of the European Union (December 2024)
  7. CycloneDX, “Vulnerability Disclosure Report (VDR),” OWASP CycloneDX
  8. NIST SP 800-161r1, “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,” National Institute of Standards and Technology (2022)
  9. Sigstore Project, “Sigstore: A New Standard for Signing, Verifying, and Protecting Software,” OpenSSF
  10. in-toto Project, “in-toto: A Framework to Secure the Integrity of Software Supply Chains,” Cloud Native Computing Foundation
  11. SLSA Project, “Supply-chain Levels for Software Artifacts (SLSA),” OpenSSF
  12. CycloneDX, “CycloneDX Attestations (CDXA),” OWASP CycloneDX
  13. NIST SP 800-218, “Secure Software Development Framework (SSDF) Version 1.1,” National Institute of Standards and Technology (2022)
  14. CISA, “Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management” (November 2023)
  15. OMB M-26-05, “Strengthening and Streamlining Federal Cybersecurity Procurement Requirements,” Office of Management and Budget (January 2026)
  16. CycloneDX, “SaaSBOM: Software as a Service Bill of Materials,” OWASP CycloneDX
  17. CycloneDX, “ML-BOM: Machine Learning Bill of Materials,” OWASP CycloneDX
  18. NIST, “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” National Institute of Standards and Technology (2023)
  19. European Parliament and Council, Regulation (EU) 2024/1689 — Artificial Intelligence Act, Official Journal of the European Union (July 2024)
  20. NIST, “Post-Quantum Cryptography Standardization,” National Institute of Standards and Technology
  21. CycloneDX, “CBOM: Cryptography Bill of Materials,” OWASP CycloneDX
  22. NSA, “Post-Quantum Cybersecurity Resources,” National Security Agency
  23. CycloneDX 1.7 Specification Overview, OWASP CycloneDX (October 2025)
  24. SPDX 3.0 Specification, The Linux Foundation (2024)
  25. OWASP Dependency-Track, “Intelligent Component Analysis Platform,” OWASP Foundation
  26. ECMA TC54, “Transparency Exchange API (TEA),” ECMA International
  27. NTIA, “SBOM Tool Classification Taxonomy,” National Telecommunications and Information Administration (March 2021)
  28. CISA, “2026 Minimum Elements for a Software Bill of Materials (SBOM),” Cybersecurity and Infrastructure Security Agency
  29. FTC, “FTC Safeguards Rule: What Your Business Needs to Know,” Federal Trade Commission
  30. HHS, “The Security Rule,” U.S. Department of Health and Human Services
  31. PCI Security Standards Council, “PCI DSS v4.0,” Document Library
  32. NIST, “Cybersecurity Framework (CSF) 2.0,” National Institute of Standards and Technology (2024)
  33. CIS, “CIS Critical Security Controls Version 8,” Center for Internet Security
  34. SEC, “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure,” Final Rule, Release No. 33-11216 (2023)