Skip to content

Software Bill of Materials

What is Software Bill of Materials?

A comprehensive inventory of all components, libraries, and dependencies used in a software application, supporting vulnerability management and supply chain security.

Information Security

Terms that appear alongside software bill of materials

Each of these is named in at least one of the same controls as software bill of materials. The number is how many controls name both.

Frameworks that govern software bill of materials

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →ISO 27001:2022View framework →

What the standards actually require on software bill of materials

Requirements naming software bill of materials across 6 standards, quoted from the control text.

Australian Information Security Manual3 controls

A software bill of materials is produced and made available to consumers of software.

ISM-1730 · A software bill of materials is produced and made available to consumers of software. →
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems1 control

UR E27 requires equipment manufacturers to provide Software Bill of Materials (SBOM) and demonstrate secure development. SBOM contents per CISA SBOM Minimum Elements + SPDX or CycloneDX format: component name + version + supplier + license + dependency relatio...

IACS-UR-E27-SBOM-SecureDev-TypeApproval-SoftwareIntegrity · IACS UR E27 - Software Bill of Materials + Secure Development Lifecycle + Type Approval + Software Integrity →
NIST SP 800-1611 control

Obtain and use a software bill of materials for acquired and produced software to support vulnerability management, licence compliance, and provenance tracking.

SCRM-COMP-2 · Software Bill of Materials Use →
NIST SP 800-2181 control

Produce a software bill of materials for each release in a machine readable format. Make it available to customers and use it internally to triage component vulnerabilities.

SP800-218-PS.3.2 · Software Bill of Materials →
EU Network Code on Cybersecurity for the Electricity Sector2 controls

Article 54 establishes SUPPLY CHAIN CYBERSECURITY requirements for high-impact + critical-impact entities. Suppliers + service providers + software vendors providing components or services with cyber-physical-system implications must: (a) meet the Article 30 m...

NCCS-Art.54_55_56 · Supply chain cybersecurity (NCCS Articles 54-56) →
ISMAP (Japan)2 controls

ISMAP Cloud Infrastructure controls cover the underlying compute + network + storage + management plane. (1) Virtual Network Segmentation: VPC Virtual Private Cloud isolation + subnets + security groups + NACLs + microsegmentation + service mesh (Istio + Linke...

ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement · ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC →

Questions people ask about software bill of materials

What is Software Bill of Materials?
A comprehensive inventory of all components, libraries, and dependencies used in a software application, supporting vulnerability management and supply chain security.
Why is Software Bill of Materials important for compliance?
Software Bill of Materials is a key concept in Information Security. Understanding software bill of materials helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Software Bill of Materials?
Software Bill of Materials appears in the requirement text of Australian Information Security Manual, IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems, NIST SP 800-161, NIST SP 800-218, EU Network Code on Cybersecurity for the Electricity Sector. Across these standards we have identified 10 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Software Bill of Materials?
Explore our compliance framework pages to see how software bill of materials applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Software Bill of Materials applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.