In brief

CISA, the NSA, FBI and international cybersecurity partners have released the 2026 Minimum Elements for a Software Bill of Materials, replacing the 2021 NTIA baseline. The guidance applies to all software—including open-source components, AI systems and software-as-a-service—and adds fields intended to improve provenance, integrity and automated analysis. These include the SBOM author’s digital signature, the SBOM format and version, generation context, the name and version of the tool used, the SBOM’s own version, component hashes and algorithms, and software-license information.

The update also strengthens operational expectations: SBOMs should cover all components and transitive dependencies, accompany every new release or build, and distinguish information that is genuinely unknown from data deliberately withheld. “Supplier Name” is replaced by the more precise “Component Producer,” while component records should contain at least one recognized software identifier. CISA recommends interoperable, machine-processable formats such as SPDX and CycloneDX so organizations can correlate SBOMs with vulnerability, licensing and change-management data at scale. The document does not create new requirements, and further work is still needed on SaaS, AI-specific information, validation and links between SBOMs and security advisories.

Source: Industrial Cyber

‍

‍