# The Ultimate SBOM Compliance Guide (2026) > Complete SBOM compliance guide covering the CISA 2026 minimum elements, NIST 800-53, NIST 800-171, EU Cyber Resilience Act (CRA), NIS2 Directive, UK Software Security Code of Practice, FDA medical device requirements, and PCI DSS 4.0. Includes CycloneDX and SPDX schema mappings. **TL;DR:** SBOM compliance requirements vary by jurisdiction and industry. In the US, the CISA 2026 minimum elements replaced the NTIA 2021 baseline on 29 July 2026, adding component hashes, licences, and SBOM document metadata. In the EU, the Cyber Resilience Act legally requires SBOMs for digital products, while NIS2 mandates supply chain security. The UK's Software Security Code of Practice offers voluntary guidance. Use CycloneDX or SPDX format – both are widely accepted across all frameworks. New to SBOMs? Start with [What is an SBOM?](https://sbomify.com/what-is-sbom/) to learn the basics, or explore our [SBOM generation guides](https://sbomify.com/guides/) for language-specific tutorials. Software Bill of Materials (SBOM) compliance requirements are rapidly evolving across the United States and European Union. Whether you're navigating the **NTIA minimum elements**, preparing for the **EU Cyber Resilience Act (CRA)**, meeting **NIS2 Directive** obligations, or submitting medical devices to the **FDA**, this guide provides a comprehensive reference for SBOM requirements across all major frameworks. **Feeling overwhelmed?** If all these frameworks, acronyms, and requirements look like gibberish, you're not alone. Book a demo and we'll show you which of them apply to your products, and how sbomify covers the SBOM and vulnerability-handling parts. [Book a demo](https://app.sbomify.com/enterprise-contact/) **Disclaimer:** This page represents our interpretation of the referenced frameworks and standards. While we strive for accuracy, we may have made errors or omissions. This content is provided for informational purposes only and does not constitute legal advice. For compliance decisions, consult the official source documents and seek qualified legal counsel. --- ## Compliance Frameworks ### US Frameworks - **[Executive Order 14028 (2021)](https://sbomify.com/compliance/eo-14028/)** - The binding US directive that kicked off federal SBOM adoption. _Updated:_ OMB Memorandum M-26-05 (January 2026) rescinded the mandatory attestation memos (M-22-18, M-23-16), shifting to an agency-led, risk-based approach. EO 14028 itself remains in effect. - _Who it affects:_ US federal agencies and software vendors selling to the government - **[NTIA Minimum Elements (2021)](https://sbomify.com/compliance/ntia-minimum-elements/)** - The foundational US baseline for SBOM data fields - _Who it affects:_ Software producers selling into federal or critical-infrastructure supply chains. Referenced by FDA, CISA, and other frameworks as the baseline. - **[CISA Minimum Elements (2025 Draft)](https://sbomify.com/compliance/cisa-minimum-elements/)** - Updated US guidance with new fields for hash, license, and generation context - _Who it affects:_ Organizations in US public-sector and critical-infrastructure contexts - **[FDA Medical Device Guidance (2025)](https://sbomify.com/compliance/fda-medical-device/)** - Healthcare sector SBOM requirements with lifecycle properties - _Who it affects:_ Medical device manufacturers and their software suppliers - **[NIST SP 800-53 Rev 5](https://sbomify.com/compliance/nist-800-53/)** - Federal security control catalog with supply chain risk management controls - _Who it affects:_ US federal agencies and organizations subject to FISMA - **[NIST SP 800-171 Rev 3](https://sbomify.com/compliance/nist-800-171/)** - CUI protection requirements for nonfederal systems - _Who it affects:_ DoD contractors and organizations handling Controlled Unclassified Information (CUI) ### EU Frameworks - **[EU Cyber Resilience Act (CRA)](https://sbomify.com/compliance/eu-cra/)** - Binding EU law requiring SBOMs for products with digital elements - _Who it affects:_ Manufacturers, importers, and distributors placing digital products on the EU market - **[EU NIS2 Directive](https://sbomify.com/compliance/eu-nis2/)** - EU cybersecurity law for essential and important entities - _Who it affects:_ EU entities responsible for cybersecurity risk management and incident reporting - **[BSI TR-03183-2 (v2.1.0)](https://sbomify.com/compliance/bsi-tr-03183/)** - German Federal Office for Information Security technical guideline defining concrete SBOM format and content requirements aligned with the EU CRA - _Who it affects:_ Manufacturers placing products with digital elements on the EU market, and vendors selling into German federal procurement ### UK Frameworks - **[Software Security Code of Practice (UK, May 2025)](https://sbomify.com/compliance/uk-software-security-code-of-practice/)** - Voluntary UK government code setting baseline secure software development, supply chain resilience, and customer communication expectations - _Who it affects:_ Organisations that **develop and/or sell software to businesses or other organisations** (especially B2B/proprietary software vendors and SaaS) ### Industry Standards - **[PCI DSS 4.0](https://sbomify.com/compliance/pci-dss/)** - Payment card industry software component inventory requirements - _Who it affects:_ Merchants and service providers handling cardholder data ### Reference Documents - **[CISA Framing Document (3rd Edition)](https://sbomify.com/compliance/cisa-framing/)** - Baseline attribute definitions and format normalization - _Who it affects:_ SBOM producers/consumers needing shared terminology and format crosswalk - **[CISA SBOM Sharing Lifecycle Report](https://sbomify.com/compliance/cisa-sharing-lifecycle/)** - Operational guidance for SBOM distribution - _Who it affects:_ Organizations distributing or retrieving SBOMs across supply chains --- ## Technical Resources - **[Schema Crosswalk: CycloneDX and SPDX](https://sbomify.com/compliance/schema-crosswalk/)** - Complete field mappings for CycloneDX 1.7, SPDX 2.3, and SPDX 3.0 - **[CLE: Common Lifecycle Enumeration](https://sbomify.com/compliance/cle/)** - Standard for machine-readable component lifecycle events (EOL, EOS) --- ## Master Requirements Comparison This table compares SBOM data field expectations across major frameworks. All frameworks assume machine-readable SBOMs in a commonly used format (e.g., CycloneDX, SPDX). **Framework context:** - **EO 14028** is a binding US Executive Order for federal agencies and influences procurement expectations for software suppliers - **NTIA 2021** and **CISA 2025** are US guidance documents (not law) - **NIST 800-53** is the federal security control catalog; **NIST 800-171** applies to nonfederal organizations handling CUI - **CRA** and **NIS2** are binding EU legislation - **FDA 2025** is guidance for medical device premarket submissions - **PCI DSS 4.0** is an industry standard for payment card security - **UK SSCoP 2025** is voluntary UK government guidance for software vendors | Property | EO 14028 | NTIA 2021 | CISA 2025 | CRA | NIS2 | FDA 2025 | PCI DSS 4.0 | UK SSCoP 2025 | | ------------------------------- | :------: | :-------: | :-------: | :-: | :--: | :------: | :---------: | :-----------: | | **Document-Level Metadata** | | | | | | | | | | SBOM Author | - | ✓ | ✓ | - | - | ✓ | - | - | | Timestamp | - | ✓ | ✓ | - | - | ✓ | - | - | | Tool Name/Version | - | - | ✓ | - | - | - | - | - | | Generation Context | - | - | ✓ | - | - | - | - | - | | **Component Identification** | | | | | | | | | | Supplier / Software Producer | - | ✓ | ✓ | - | - | ✓ | - | - | | Component Name | - | ✓ | ✓ | - | ● | ✓ | - | - | | Component Version | - | ✓ | ✓ | - | ● | ✓ | - | - | | Unique Identifiers (purl/CPE) | - | ✓ | ✓ | - | - | ✓ | - | - | | Component Hash | - | - | ✓ | - | - | - | - | - | | **Relationships** | | | | | | | | | | Dependency Relationship | ● | ✓ | ✓ | ✓* | - | ✓ | - | - | | **Legal** | | | | | | | | | | License | - | - | ✓ | - | - | - | - | - | | **Lifecycle** | | | | | | | | | | Support Level | - | - | - | - | - | ✓ | - | ✓‡ | | End-of-Support Date | - | - | - | - | - | ✓ | - | ✓‡ | | **Process / Access** | | | | | | | | | | SBOM provision to purchasers | ✓ | - | - | - | - | - | - | - | | SBOM production required | - | - | - | ✓ | - | - | ✓† | - | | Authority access on request | - | - | - | ● | - | - | - | - | | User access location disclosure | - | - | - | ● | - | - | - | - | | Supply chain security measures | ✓ | - | - | - | ✓ | - | ✓† | ✓‡ | | Vulnerability handling process | ✓ | - | - | - | ✓ | - | ✓† | ✓‡ | **Legend:** - **✓** = Expected (NTIA/CISA minimum element, FDA recommended, EO 14028/NIS2 required) - **✓*** = CRA requires at least top-level (direct) dependencies - **✓†** = PCI DSS Req 6.3.2 (best practice until 31 Mar 2025, then required) - **✓‡** = UK SSCoP voluntary guidance (not as SBOM fields, but as customer-facing expectations) - **●** = Conditional or implied (EO 14028: SBOM must include "supply chain relationships"; CRA: where applicable; NIS2: for in-scope entities per Regulation 2024/2690) - **-** = Not specified by this framework **Important notes:** - EO 14028 requires SBOM provision in federal procurement but defers field-level requirements to NTIA minimum elements. Note: OMB M-26-05 (January 2026) rescinded the mandatory attestation memos (M-22-18, M-23-16), making vendor attestations optional and shifting to agency-led risk-based assurance. EO 14028's core SBOM and supply chain provisions remain in effect - NTIA 2021 and CISA 2025 define "minimum elements" as guidance, not legal requirements - NTIA 2021 discusses license information as a key SBOM use case and useful content, but it is not listed among the minimum SBOM data fields - CISA 2026 is final guidance and explicitly does not create new requirements - FDA uses "should" language (recommendations for premarket submissions) - CRA is binding law but does not specify individual data fields beyond dependency scope - NIS2 does not mandate SBOMs by name, but the implementing regulation (2024/2690) requires "information describing the hardware and software components used" for in-scope entities - PCI DSS 4.0 requires software component inventories for bespoke/custom software (Req 6.3.2) to facilitate vulnerability and patch management - UK SSCoP 2025 is voluntary guidance; it does not mandate SBOMs by name but expects software composition awareness, vulnerability management, and customer lifecycle communication --- ## Frequently Asked Questions ### What is SBOM compliance? SBOM compliance refers to meeting the requirements set by various government regulations and industry standards for creating, maintaining, and sharing Software Bills of Materials. Key frameworks include the US [NTIA minimum elements](https://sbomify.com/compliance/ntia-minimum-elements/), the EU [Cyber Resilience Act](https://sbomify.com/compliance/eu-cra/), and sector-specific requirements like [FDA medical device guidance](https://sbomify.com/compliance/fda-medical-device/). ### Is an SBOM legally required? It depends on your jurisdiction and industry. In the EU, the [Cyber Resilience Act](https://sbomify.com/compliance/eu-cra/) legally requires SBOMs for products with digital elements. In the US, SBOMs are required for software sold to the federal government (per [Executive Order 14028](https://sbomify.com/compliance/eo-14028/)) and recommended for [FDA medical device submissions](https://sbomify.com/compliance/fda-medical-device/). The [NIS2 Directive](https://sbomify.com/compliance/eu-nis2/) requires supply chain security measures that SBOMs help evidence. ### What format should my SBOM be in? Both [CycloneDX](https://cyclonedx.org/) and [SPDX](https://spdx.dev/) are widely accepted. The EU CRA requires a "commonly used and machine-readable format," and both formats qualify. See our [schema crosswalk](https://sbomify.com/compliance/schema-crosswalk/) for field mappings between formats. ### What are the minimum SBOM fields required? The [CISA 2026 minimum elements](https://sbomify.com/compliance/cisa-minimum-elements/) define 23 elements in three groups: nine SBOM Metadata fields, eight Component Data fields, and six Practices and Processes. They replaced the seven fields of the [NTIA 2021 baseline](https://sbomify.com/compliance/ntia-minimum-elements/) on 29 July 2026, adding ten new elements including Component Hash Value, Component Hash Algorithm, Component License, and SBOM Author Signature. ### How do I generate an SBOM? See our comprehensive [SBOM generation guides](https://sbomify.com/guides/) covering Python, JavaScript, Java, Go, Rust, and 10+ other languages and platforms. For a list of tools, visit our [SBOM resources page](https://sbomify.com/resources/). --- ## Additional Resources **Official Source Documents:** - [Executive Order 14028 – Improving the Nation's Cybersecurity (2021)](https://www.gsa.gov/technology/government-it-initiatives/cybersecurity/executive-order-14028) - [NTIA Minimum Elements for a Software Bill of Materials (2021)](https://www.ntia.gov/sites/default/files/publications/sbom_minimum_elements_report_0.pdf) - [2026 Minimum Elements for a Software Bill of Materials (SBOM)](https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom) - [CISA Framing Software Component Transparency (3rd Edition)](https://www.cisa.gov/sites/default/files/2024-10/SBOM%20Framing%20Software%20Component%20Transparency%202024.pdf) - [CISA SBOM Sharing Lifecycle Report](https://www.cisa.gov/sites/default/files/2023-04/sbom-sharing-lifecycle-report_508.pdf) - [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) - [EU NIS2 Directive (Directive 2022/2555)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022L2555) - [PCI DSS v4.0.1 (June 2024)](https://www.pcisecuritystandards.org/document_library/) - [NIST SP 800-53 Rev 5 (September 2020, updated December 2024)](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) - [NIST SP 800-171 Rev 3 (May 2024)](https://csrc.nist.gov/pubs/sp/800/171/r3/final) - [Software Security Code of Practice (UK Government, May 2025)](https://www.gov.uk/government/publications/software-security-code-of-practice) - [CLE Specification (ECMA-428)](https://ecma-international.org/publications-and-standards/standards/ecma-428/) **Related sbomify Resources:** - [What is an SBOM?](https://sbomify.com/what-is-sbom/) - Introduction to Software Bills of Materials - [SBOM Generation Guides](https://sbomify.com/guides/) - Language and platform-specific tutorials - [SBOM Resources & Tools](https://sbomify.com/resources/) - Comprehensive tool directory [Edit this page on GitHub](https://github.com/sbomify/sbomify.com/blob/master/compliance.md) ## Pages - [BSI TR-03183-2: SBOM Requirements (v2.1.0)](https://sbomify.com/compliance/bsi-tr-03183/): Guide to the German Federal Office for Information Security (BSI) Technical Guideline TR-03183-2 v2.1.0, which defines SBOM format and content requirements aligned with the EU Cyber Resilience Act. - [CISA 2026 SBOM Minimum Elements: All 23 Elements Listed](https://sbomify.com/compliance/cisa-minimum-elements/): The 2026 Minimum Elements for a Software Bill of Materials, published 29 July 2026 by CISA with 17 partner agencies. Updates and replaces the NTIA 2021 baseline. Covers all 23 elements across SBOM Metadata, Component Data, and Practices and Processes, with the full change log from 2021. - [CISA Framing Software Component Transparency (3rd Edition)](https://sbomify.com/compliance/cisa-framing/): Guide to the CISA Framing document, the authoritative source for SBOM baseline attributes and CycloneDX/SPDX schema crosswalk. - [CISA SBOM Sharing Lifecycle Report (2023)](https://sbomify.com/compliance/cisa-sharing-lifecycle/): Guide to the CISA SBOM Sharing Lifecycle Report, covering discovery, access, and transport patterns for SBOM distribution across supply chains. - [CLE: Common Lifecycle Enumeration for SBOMs](https://sbomify.com/compliance/cle/): Guide to CLE (ECMA-428), the standard for machine-readable component lifecycle events including end-of-life, end-of-support, and provenance changes. - [EU Cyber Resilience Act (CRA) SBOM Requirements](https://sbomify.com/compliance/eu-cra/): What the CRA requires of your SBOM: format, fields and dependency depth under BSI TR-03183, the 11 September 2026 reporting deadline, and a checklist. - [EU NIS2 Directive SBOM Requirements](https://sbomify.com/compliance/eu-nis2/): Understanding NIS2 Directive cybersecurity requirements and how SBOMs support supply chain security, asset management, and incident response. - [Executive Order 14028 SBOM Requirements](https://sbomify.com/compliance/eo-14028/): Understanding Executive Order 14028 and its SBOM requirements for US federal agencies and software vendors selling to the government. - [FDA Medical Device SBOM Requirements (2025)](https://sbomify.com/compliance/fda-medical-device/): Guide to FDA cybersecurity guidance for medical devices, including SBOM requirements, support level, and end-of-support date expectations. - [NIST 800-53 and SBOM Requirements: Security Controls for Software Supply Chains](https://sbomify.com/compliance/nist-800-53/): How NIST SP 800-53 Rev 5 security controls relate to SBOM requirements, covering the SA and SR control families for software supply chain risk management. - [NIST SP 800-171 SBOM Requirements: Protecting CUI in Software Supply Chains](https://sbomify.com/compliance/nist-800-171/): How NIST SP 800-171 Rev 3 supply chain and component inventory controls relate to SBOM requirements for organizations handling Controlled Unclassified Information. Includes the CMMC phased rollout timeline through 2028. - [NTIA Minimum Elements for SBOM (2021, Superseded)](https://sbomify.com/compliance/ntia-minimum-elements/): The NTIA 2021 Minimum Elements for a Software Bill of Materials, the original US SBOM baseline, updated and replaced by the CISA 2026 Minimum Elements on 29 July 2026. Covers the original seven data fields and how each maps to its 2026 successor. - [PCI DSS 4.0 SBOM and Software Inventory Requirements](https://sbomify.com/compliance/pci-dss/): Guide to PCI DSS 4.0 software component inventory requirements, including Requirement 6.3.2 for bespoke software and third-party dependencies. - [SBOM Schema Crosswalk: CycloneDX and SPDX Field Mappings](https://sbomify.com/compliance/schema-crosswalk/): Field mapping reference for the CISA 2026 SBOM Minimum Elements across CycloneDX 1.6/1.7, SPDX 2.3 and SPDX 3.0, plus a general crosswalk for SBOM properties across formats. - [Software Security Code of Practice (UK, May 2025)](https://sbomify.com/compliance/uk-software-security-code-of-practice/): Guide to the UK Software Security Code of Practice, a voluntary government code for secure software development, supply chain resilience, and customer communication. --- From sbomify: https://sbomify.com/compliance/