The US Cybersecurity and Infrastructure Security Agency (CISA) has released the 2026 Minimum Elements for a Software Bill of Materials (SBOM), replacing the 2021 NTIA guidance and expanding requirements to reflect today’s software supply chain risks. SBOMs list the components within a software package and help organizations assess dependencies, vulnerabilities and supplier relationships.
The updated framework incorporates feedback from a 2025 public comment period and applies the minimum elements to SBOMs for all software. New required fields include component hash algorithms, component licenses, the SBOM generation tool name and generation context. Several existing fields were renamed to improve clarity and support automated supply chain and vulnerability management workflows.
CISA also highlights four areas where SBOM guidance must evolve: cloud software, AI systems, SBOM authenticity and linking SBOMs to security alerts. Cloud and SaaS products pose challenges due to shared responsibility and constant change, prompting discussion of automated snapshots and potential future cloud‑specific elements. AI systems introduce additional artifacts such as model cards and data cards, which current SBOMs do not capture; CISA points to separate G7 AI SBOM guidance for now.
The update adds a digital signature field to help recipients verify SBOM integrity, and encourages linking SBOMs with formats like VEX and CSAF to quickly determine whether new vulnerabilities affect deployed software.
