Government agencies from the United States and 13 allied countries this week published updated guidance on the minimum elements required in a software bill of materials (SBOM). The revision builds on the original SBOM Minimum Elements document released by NTIA in 2021 and incorporates feedback gathered during a public comment period last year.

The authoring agencies describe an SBOM as a foundational component of software security and supply chain risk management, enabling organizations to build accurate inventories of the software and components running in their environments. The updated document aims to give organizations a clearer baseline for what technologies and practices an SBOM should capture, supporting better-informed risk decisions around known and newly discovered vulnerabilities.

What Changed

The guidance preserves the core structure of the 2021 release but improves data quality, broadens supported use cases, and clarifies several definitions. New elements added to the baseline include:

  • Component Hash Algorithm and Component Hash Value
  • Component License
  • Author Signature
  • Data Format Name and Data Format Version
  • Generation Context
  • Tool Name and Tool Version
  • SBOM Version

Only two elements were removed entirely: Access Control and Software Identification (SWID) Tags. A number of other fields were replaced, rewritten for clarity, or adjusted to improve data mapping. The Component Name field, for example, now supports multiple entries rather than a single value.

Why It Matters

The agencies note that SBOM tooling has matured significantly since 2021, driven by a growing base of organizations generating, sharing, consuming, and analyzing SBOM data. That maturity has raised expectations for how much supply chain detail organizations can reasonably request from vendors and software producers.

The guidance applies broadly to all software but flags that certain categories, including AI systems and SaaS offerings, may require additional elements beyond this baseline. That follows related work from G7 nations, which released SBOM guidance specific to AI systems earlier this year.

For security teams, the update signals a shift toward more granular, verifiable supply chain data, particularly around component integrity (via hashing), licensing obligations, and the provenance of the tools used to generate SBOMs themselves. Organizations that already consume or produce SBOMs should review the new elements against their current tooling and data pipelines to identify gaps ahead of broader adoption.