+2.1.1 Data Model

2.1.1 Data Model

With the aim to enable interoperability and consistency throughout the SBOM generation and consumption, authoritative bodies have published guidance on the data fields for SBOMs. The

German Federal Office for Information Security (BSI) has published a technical guideline defining the required data fields, while the U.S. Cybersecurity and Infrastructure Security

Agency (CISA), building upon the existing work previously published by the National Telecommunications and Information Administration (NTIA), defines the “Minimum Elements for a Software Bill of Materials”. Both publications provide a baseline for generating SBOMs.

The table below attempts to map the BSI required data fields with the U.S. CISA defined minimum elements in an effort to support organisations in producing SBOMs that satisfy international interoperability and regulatory requirements.

Data Fields

Technical Guideline BSI TR-03183: Part 2 Software Bill of Materials (6)

Data Fields

U.S. CISA

“Minimum Elements for a

Software Bill of Materials

(SBOM)” (7)

SBOM Metadata

Creator of the SBOM

Email address of the entity that

SBOM Author

The name of the entity that creates the SBOM data for the primary component.

created the SBOM. If no email

address is available this MUST

be a “Uniform Resource Locator

(URL)”, e.g. the creator’s home

page or the project’s web page.

SBOM Version

Identifier designated by the

SBOM Author to specify a

change in the SBOM

document from a previously

identified version or to indicate

that it is the first version.

SBOM-URI

“Uniform Resource Identifier

(URI)” of this SBOM.

SBOM Data Format Name

The name of the data format

used to represent the SBOM

data.

SBOM Data Format Version

Identifier designated by the

SBOM data format to specify

the version of the data format.

-	-		SBOM Author	A digital signature attributable
			Signature	to the SBOM Author.
-	-	SBOM Tool Name		The name of the tool used by

the SBOM Author to generate

or amend the SBOM.

SBOM Tool Version

Identifier for the version of the

tool identified in the SBOM

Tool Name element.

Timestamp

Date and time of the SBOM data

SBOM Timestamp

Record of the date and time of the most recent update to the SBOM data.

compilation according to the

specification of the formats.

Note: It is recommended to only

use timestamps in UTC.

SBOM Generation Context

The relative software lifecycle

phase and data available at

the time the SBOM Author

generated the SBOM (before

build, during build, after build).

Component Data

Component creator

Email address of the entity that

Component Producer

The name of an entity that creates, defines, and identifies components.

created and, if applicable,

maintains the respective

component. If no email address

is available this MUST be a

“Uniform Resource Locator

(URL)”.

Component name

Name assigned to the

Component Name

The name assigned by the Component Producer to a software component.

component by the component

creator. If no name is assigned

this MUST be the actual

filename.

	Filename of the		The actual filename of the
	component		component.
Component version		Identifier used by the creator to specify changes in the component to a previously created version.		Component Version	Identifier used by the

Component Creator to specify

a change in a software

component from a previously

identified version or to indicate

that it is the first version.

Source code URI

“Uniform Resource Identifier

Component Identifiers

Identifier(s) used to identify a component or serve as a look-up key for relevant databases.

(URI)” of the source code of the

component, e.g. the URL of the

utilised source code version in

its repository, or if a version

cannot be specified the utilised

source code repository itself.

	URI of the	“Uniform Resource Identifier
	deployable	(URI)”, which points directly to
	form of the	the deployable form of the
	component	component.
Other unique identifiers		Other identifiers that can be

used to identify the component

or to look it up in relevant

databases, such as Common

Platform Enumeration (CPE) or

Package URL (purl).

URL of the security.txt (optional)

Contains the “Uniform Resource

Locator (URL)” of the

component

creator’s security.txt.

Hash value of the deployable component

Cryptographically secure

Component Hash Value

The output generated from applying a cryptographic hash algorithm to an executable component artifact.

checksum (hash value) of the

deployed/ deployable

component.

Hash value of the source code of the component (optional)

Cryptographically secure

checksum (hash value) of the

component source code. A

specific algorithm how to create

a hash value of multiple source

files or a source code tree, and

which hash algorithm is utilised

for that has not yet been

determined.

Component Hash Algorithm

The cryptographic algorithm

used to compute the

Component Hash Value of the

software component.

Distribution licences

Distribution licence(s) of the

Component License

The identifier(s) for the license(s) under which the software component is available.

component under which it can

be used by a licensee.

Original licences

The licence(s) that have been

assigned by the creator of the

component.

Effective license (optional)

The licence under which the

component is used by the

licensee that is the creator of the

current SBOM.

Dependencies on other components	Enumeration of all components	Component Dependency Relationship		The relationship between two
	on which this component is			components, given that one
	directly dependent, or which this			component is necessary for
	component contains.			the operation of the other.
Executable property	Describes whether the	-	-

component is executable;

possible values are “executable”

and “non-executable”.

Archive property

Describes whether the

component is an archive;

possible values are “archive”

and “no archive”.

Structured property

Describes whether the

component is a structured file,

i.e. metadata of the contents is

still present; possible values are

“structured” and “unstructured”.

Table 1 - Data Models

1. Ülevaade

Pealkiri	Standard

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

Nõuded
Allikas	Nõue

3. Seotud regulatsioonid

Regulatsioonid
Allikas	Regulatsioon

ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.