{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/sbom","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/sbom/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/sbom/"},"term":{"en":"Software bill of materials (SBOM)","da":"Softwarestykliste (SBOM)"},"aka":{"en":["SBOM"],"da":["SBOM"]},"domain":["platform","security"],"cluster":"delivery","layer":"delivery","status":"current","era":2018,"summary":{"en":"A list of every component and outside library a piece of software contains, so its owners know exactly what is inside it.","da":"En liste over alle komponenter og eksterne biblioteker, et stykke software indeholder, så man ved præcis, hvad det består af."},"body":{"formal":{"en":"A record in a format machines can read that lists the parts of a software product, giving at least each part's supplier, name, version and unique ID, how the parts depend on each other, and who made the record and when.","da":"En liste i et format, som maskiner kan læse, over delene i et softwareprodukt med mindst hver dels leverandør, navn, version og et unikt ID, hvordan delene afhænger af hinanden, og hvem der lavede listen og hvornår."},"plain":{"en":"Like the parts list that comes with a car; when a maker recalls a faulty brake part, every owner can quickly check whether their car has it.","da":"Som reservedelslisten til en bil; når en producent tilbagekalder en defekt bremsedel, kan alle ejere hurtigt tjekke, om deres bil har den."},"inPractice":{"en":"When the Danish Resilience Agency warns of a serious flaw in a widely used logging library, a region's security team searches its SBOMs and within an hour finds the eleven hospital systems that use the affected version.","da":"Da SAMSIK advarer om en alvorlig sårbarhed i et udbredt bibliotek til logs, søger regionens sikkerhedsteam i sine SBOM'er og finder inden for en time de elleve hospitalssystemer, der bruger den ramte version."},"whyItMatters":{"en":"Nobody can fix what they do not know they have; US federal rules have asked software suppliers for SBOMs since 2021, and the Cyber Resilience Act requires makers of products sold in the EU to draw one up.","da":"Man kan ikke rette det, man ikke ved, man har; amerikanske statslige regler har siden 2021 bedt softwareleverandører om SBOM'er, og Cyberrobusthedsforordningen kræver, at producenter af produkter, der sælges i EU, udarbejder en."}},"deepDive":{"en":"The modern SBOM effort began with the US NTIA multistakeholder process in 2018 and was given regulatory weight by Executive Order 14028 (May 2021), after which NTIA published The Minimum Elements for an SBOM (July 2021). It defines three groups: data fields (supplier name, component name, version, other unique identifiers, dependency relationship, author of the SBOM data and timestamp), automation support (a machine-readable format - SPDX, CycloneDX or SWID tags), and practices and processes (frequency of regeneration, depth, handling of known unknowns, distribution and access control).\n\nTwo formats dominate. SPDX, from the Linux Foundation, was standardised as ISO/IEC 5962:2021 (SPDX 2.2.1); SPDX 3.0 (2024) restructured the model into profiles for security, licensing, AI and datasets. CycloneDX, from OWASP, is standardised by Ecma as ECMA-424 (first edition June 2024, second edition December 2025) and also covers services, hardware, machine-learning models (ML-BOM), cryptographic assets (CBOM) and embedded vulnerability or VEX data. Components are identified by Package URLs (purl, e.g. pkg:npm/lodash@4.17.21) and sometimes CPE names; accurate identifiers are what make automated vulnerability matching possible, and inconsistent CPEs are a common cause of both false positives and misses.\n\nSBOMs differ by when they are produced; CISA's taxonomy distinguishes design, source, build, analysed, deployed and runtime SBOMs. A build SBOM generated by the package manager or build tool during compilation is usually the most complete; an analysed SBOM produced by scanning a finished binary or container image (Syft, Trivy, cdxgen) can miss statically linked, vendored or shaded code. Depth matters: many dependencies are transitive, and an SBOM listing only direct dependencies would have hidden most Log4j exposure in 2021. SBOMs are commonly attached to releases or container images as signed in-toto attestations so recipients can verify their origin.\n\nAn SBOM is an inventory, not an assessment. Its value appears when it is ingested into tooling (for example OWASP Dependency-Track) and continuously correlated with vulnerability data, and when paired with VEX (Vulnerability Exploitability eXchange, in CSAF or OpenVEX form), in which the supplier states whether a listed vulnerability actually affects the product. In the EU, the Cyber Resilience Act (Regulation (EU) 2024/2847), Annex I Part II point 1, requires manufacturers to identify and document components, including by drawing up an SBOM in a commonly used, machine-readable format covering at the very least the top-level dependencies; the SBOM belongs to the technical documentation and need not be published. The CRA's main obligations apply from 11 December 2027, while its vulnerability-reporting duties have applied since 11 September 2026. SBOM differs from software composition analysis, which is the process that consumes or produces such inventories to find vulnerable and non-compliant components.","da":"Det moderne SBOM-arbejde begyndte med den amerikanske NTIA's multistakeholder-proces i 2018 og fik regulatorisk vægt med Executive Order 14028 (maj 2021), hvorefter NTIA udgav The Minimum Elements for an SBOM (juli 2021). Den definerer tre grupper: datafelter (leverandørnavn, komponentnavn, version, andre unikke identifikatorer, afhængighedsforhold, forfatter til SBOM-data og tidsstempel), understøttelse af automatisering (et maskinlæsbart format - SPDX, CycloneDX eller SWID-tags) samt praksis og processer (hvor ofte den gendannes, dybde, håndtering af kendte ubekendte, distribution og adgangskontrol).\n\nTo formater dominerer. SPDX fra Linux Foundation blev standardiseret som ISO/IEC 5962:2021 (SPDX 2.2.1); SPDX 3.0 (2024) omstrukturerede modellen i profiler for sikkerhed, licenser, AI og datasæt. CycloneDX fra OWASP er standardiseret af Ecma som ECMA-424 (første udgave juni 2024, anden udgave december 2025) og dækker også tjenester, hardware, maskinlæringsmodeller (ML-BOM), kryptografiske aktiver (CBOM) og indlejrede sårbarheds- eller VEX-data. Komponenter identificeres med Package URLs (purl, fx pkg:npm/lodash@4.17.21) og undertiden CPE-navne; præcise identifikatorer er det, der gør automatisk matchning af sårbarheder mulig, og inkonsistente CPE'er er en almindelig årsag til både falske positiver og oversete fund.\n\nSBOM'er adskiller sig efter, hvornår de laves; CISA's taksonomi skelner mellem design-, kilde-, build-, analyserede, udrullede og runtime-SBOM'er. En build-SBOM, som pakkehåndteringen eller byggeværktøjet genererer under kompileringen, er som regel den mest komplette; en analyseret SBOM, lavet ved at scanne en færdig binær eller et container-image (Syft, Trivy, cdxgen), kan overse statisk linket, vendoreret eller shadet kode. Dybden betyder noget: mange afhængigheder er transitive, og en SBOM med kun direkte afhængigheder ville have skjult det meste af Log4j-eksponeringen i 2021. SBOM'er vedhæftes ofte udgivelser eller container-images som signerede in-toto-attestationer, så modtagerne kan verificere deres oprindelse.\n\nEn SBOM er en fortegnelse, ikke en vurdering. Værdien viser sig, når den indlæses i værktøjer (fx OWASP Dependency-Track) og løbende sammenholdes med sårbarhedsdata, og når den kombineres med VEX (Vulnerability Exploitability eXchange i CSAF- eller OpenVEX-form), hvor leverandøren oplyser, om en listet sårbarhed faktisk rammer produktet. I EU kræver Cyberrobusthedsforordningen (forordning (EU) 2024/2847), bilag I, del II, punkt 1, at producenter identificerer og dokumenterer komponenter, bl.a. ved at udarbejde en SBOM i et almindeligt anvendt, maskinlæsbart format, der som minimum dækker de øverste afhængigheder; SBOM'en er en del af den tekniske dokumentation og skal ikke offentliggøres. Forordningens hovedforpligtelser gælder fra 11. december 2027, mens pligten til at indberette sårbarheder har gældt siden 11. september 2026. SBOM adskiller sig fra software composition analysis, som er den proces, der bruger eller producerer sådanne fortegnelser for at finde sårbare og ikke-kompatible komponenter."},"edges":[{"type":"requires","to":"platform/software-supply-chain","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/supply-chain-attack","why":{"en":"A list of every component in a product lets a team find a compromised or flawed one quickly.","da":"En liste over alle komponenter i et produkt lader et team hurtigt finde en kompromitteret eller fejlbehæftet del."},"confidence":"medium","strength":"normal"},{"type":"mitigates","to":"ai/ai-supply-chain-attack","why":{"en":"Listing every model, dataset and library a system uses lets a team find and replace a tampered part quickly.","da":"En liste over alle modeller, datasæt og biblioteker, et system bruger, lader et team hurtigt finde og udskifte en manipuleret del."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"platform/software-composition-analysis","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/supplier-management","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/vulnerability-scanning","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"The Minimum Elements For a Software Bill of Materials (SBOM)","url":"https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom","tier":"standard","publisher":"NTIA, US Department of Commerce"},{"title":"Regulation (EU) 2024/2847 - Cyber Resilience Act, Annex I","url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj","tier":"standard","publisher":"European Union"},{"title":"NIST SP 800-218 - Secure Software Development Framework (SSDF)","url":"https://csrc.nist.gov/pubs/sp/800/218/final","tier":"standard","publisher":"NIST"},{"title":"ECMA-424 - CycloneDX Bill of Materials Specification","url":"https://ecma-international.org/publications-and-standards/standards/ecma-424/","tier":"standard","publisher":"Ecma International"}],"draft":true}