When is an SBOM not an SBOM? CISA's Minimum Elements

"CISA's guidance forms part of a global effort to set a higher baseline for artifact provenance and software security. For example, the EU Cyber Resilience Act (CRA) legally mandates 'security by design' for all products with digital elements, including a requirement for firms to create, maintain, and retain an SBOM for all products sold in the EU."

"Minimum Elements sets the baseline standard for what 'good' looks like in an SBOM. It includes items like cryptographic 'Component Hashes' to clearly identify dependencies and 'Generation Context' to document the timeline of how an SBOM was created."

"With the CRA making SBOMs a legal requirement, and CISA expanding the technical definition of a credible SBOM, we're seeing the emergence of a higher global baseline - and organizations that do not meet it will be left behind."

CISA released updated guidance on Software Bills of Materials (SBOMs) in August 2025, introducing 'Minimum Elements' that define baseline standards for credible SBOMs. Key additions include cryptographic Component Hashes for identifying dependencies and Generation Context documenting SBOM creation timelines. Concurrently, the EU Cyber Resilience Act legally mandates SBOMs for all products with digital elements sold in Europe, requiring firms to create, maintain, and retain them. This regulatory requirement transforms SBOMs from optional best practices to mandatory compliance measures. The guidance also updates existing SBOM fields like SBOM Author, Component Version, and Software Identifiers to reduce ambiguity and enable better risk-informed security decisions. Together, these developments establish a higher global baseline for artifact provenance and software security that organizations cannot ignore.

Read at Techzine Global