+2.1.2 SBOM Formats

2.1.2 SBOM Formats

The SBOM format is also a determining factor for interoperability across the software supply chain. Standardized formats provide a common data model that enables software producers, consumers, security tools, vulnerability management platforms, and compliance solutions to process and exchange software composition analysis information in a consistent manner.

ENISA’s SBOM Adoption State of Play 2026 mentions that almost 73% of the organisations use CycloneDX or SPDX.Table 2 presents the two predominant formats based on their current version.

SPDX (System Package DataCycloneDX V 1.7 (9)

Exchange) V 3.0.1 (8)

DescriptionComprehensive framework forSecurity-focused approach to software bill of materials, emphasising vulnerability tracking, cryptographic integrity, and comprehensive dependency analysis.

documenting system component

information, with a historical focus

on supporting detailed software

metadata to enable tracking of

vulnerabilities, licensing, and

dependencies for product lines.

Standard/BackingSPDX® Specification v2.2.1 is anRatified as ECMA-424 by ECMA International (11). Maintains a formal standardisation process and governance model through ECMA Technical Committee 54 (TC54). Currently pursuing ISO JTC1 FastTrack.

ISO-standardised format (ISO/IEC

5962:2021).

SPDX 3. in process at ISO to be

listed as an update to ISO/IEC

5962:2021.

SPDX 3.0 has been ratified as an

OMG standard (10).

Key RequirementRisk Analysis: Providing clear,Vulnerability Management: Enabling precise correlation between components and security vulnerabilities with native VEX (Vulnerability Exploitability eXchange) support.

machine-readable metadata to

support product line risk analysis,

including vulnerability management

(native CVE & VEX metadata, CSAF

and other formats, precise license

compliance metadata, and

dependency tracking), precise

license compliance metadata, and

dependency tracking.

Supply Chain Transparency:Security Automation: Facilitating seamless integration with security tools and CI/CD pipelines through lightweight, efficient formats.

Enabling comprehensive component

provenance and cryptographic

integrity, together with rich

relationship options for creation of

knowledge graph.

Regulatory Alignment: MeetingOperational Visibility: Documenting not just
increasing demands for softwarestatic components but runtime services,
transparency in regulated industries.APIs, and operational dependencies.
Interoperability: Establishing a common language for softwareCryptographic Integrity: Providing robust

verification mechanisms for supply chain

attestation and component authentication.

composition across diverse

toolchains and ecosystems.

Table 2 - SBOM Formats

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations