2.1.2 SBOM Formats
The SBOM format is also a determining factor for interoperability across the software supply chain. Standardized formats provide a common data model that enables software producers, consumers, security tools, vulnerability management platforms, and compliance solutions to process and exchange software composition analysis information in a consistent manner. ENISA’s SBOM Adoption State of Play 2026 mentions that almost 73% of the organisations use CycloneDX or SPDX.Table 2 presents the two predominant formats based on their current version. | SPDX (System Package Data | CycloneDX V 1.7 (9) |
Exchange) V 3.0.1 (8) | Description | Comprehensive framework for | Security-focused approach to software bill of materials, emphasising vulnerability tracking, cryptographic integrity, and comprehensive dependency analysis. |
documenting system component information, with a historical focus on supporting detailed software metadata to enable tracking of vulnerabilities, licensing, and dependencies for product lines. | Standard/Backing | SPDX® Specification v2.2.1 is an | Ratified as ECMA-424 by ECMA International (11). Maintains a formal standardisation process and governance model through ECMA Technical Committee 54 (TC54). Currently pursuing ISO JTC1 FastTrack. |
ISO-standardised format (ISO/IEC 5962:2021). SPDX 3. in process at ISO to be listed as an update to ISO/IEC 5962:2021. SPDX 3.0 has been ratified as an OMG standard (10). | Key Requirement | Risk Analysis: Providing clear, | Vulnerability Management: Enabling precise correlation between components and security vulnerabilities with native VEX (Vulnerability Exploitability eXchange) support. |
machine-readable metadata to support product line risk analysis, including vulnerability management (native CVE & VEX metadata, CSAF and other formats, precise license compliance metadata, and dependency tracking), precise license compliance metadata, and dependency tracking. | Supply Chain Transparency: | Security Automation: Facilitating seamless integration with security tools and CI/CD pipelines through lightweight, efficient formats. |
Enabling comprehensive component provenance and cryptographic integrity, together with rich relationship options for creation of knowledge graph. | Regulatory Alignment: Meeting | Operational Visibility: Documenting not just | | increasing demands for software | static components but runtime services, | | transparency in regulated industries. | APIs, and operational dependencies. | | Interoperability: Establishing a common language for software | | Cryptographic Integrity: Providing robust |
verification mechanisms for supply chain attestation and component authentication. composition across diverse toolchains and ecosystems. Table 2 - SBOM Formats
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
- ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.
DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.
|