The 2026 Minimum Elements for a Software Bill of Materials: Check Your Latest Release Record in 30 Minutes

Why it matters now

For five years the reference list was the 2021 set of minimum elements from the National Telecommunications and Information Administration. The 2026 guidance updates it.^1,2 It adds the component hash, the component licence, the tool name and the generation context. It also adds a field for a digital signature from the author of the record, so a customer can check that the record is genuine.^3,4

Generation context matters most in practice. The official text accepts references such as "before build", "build" and "after build".⁴ A record produced during the build describes what was built. A scan afterwards infers what is inside and can miss code that was statically linked or vendored.

The guidance itself is voluntary. Federal buyers and many enterprise customers in the United States use it as their baseline. Medical device makers have had to provide a software bill of materials to the Food and Drug Administration since March 2023,⁶ and the main obligations of the European Union Cyber Resilience Act apply from 11 December 2027.⁷

Check your latest release record in 30 minutes

Step 1. Measure a CycloneDX record

Take the record for your most recent production release.

jq '{
  tools: [(.metadata.tools.components? // .metadata.tools // [])[] | .name],
  lifecycle: .metadata.lifecycles,
  signed: has("signature"),
  components: (.components // [] | length),
  with_hash: ([.components[]? | select((.hashes // []) | length > 0)] | length),
  with_license: ([.components[]? | select((.licenses // []) | length > 0)] | length),
  with_purl: ([.components[]? | select(.purl)] | length)
}' sbom.cdx.json

Since CycloneDX 1.5 the tool sits under metadata.tools.components. The older list form of metadata.tools is marked deprecated.⁵ The query reads both forms. signed only detects an embedded signature, so check for a detached signature or attestation next to the release as well.

Step 2. Or measure an SPDX 2.3 record

jq '{
  creators: .creationInfo.creators,
  packages: (.packages // [] | length),
  with_checksum: ([.packages[]? | select((.checksums // []) | length > 0)] | length),
  with_license: ([.packages[]? | select((.licenseConcluded // "NOASSERTION") != "NOASSERTION" or (.licenseDeclared // "NOASSERTION") != "NOASSERTION")] | length)
}' sbom.spdx.json

Step 3. Compare the ratios

Divide each count by the number of components. Then confirm two points: the record states its generation context, and it carries a signature.

What the result means

The move, step by step

1. Generate in the build job. Produce the record in the same pipeline run that builds the release, with build-aware tools such as Yocto create-spdx, CycloneDX build plugins, cdxgen or Syft on the build output.
2. Add hashes and identifiers. Record a cryptographic hash and a package URL for every component, and fix the components that come out without them.
3. Record tool and context. Write the tool name, its version and the lifecycle phase into the record metadata.
4. Add licences. Fill declared licences from package metadata and review the unknown entries.
5. Sign and store. Sign the record, for example as a Sigstore cosign attestation or a detached signature next to a firmware file, and store it with the release artifact.

Keep your existing format. SPDX and CycloneDX can both carry the new elements. What usually changes is when the record is produced and which fields your tools fill in.

What is still open

• Tool support for the new fields is still maturing, especially for signatures and lifecycle information.
• The guidance notes that some software types, such as artificial intelligence and software as a service in cloud environments, may require additional elements.^1,3
• The European Commission may specify its own format and elements for the record under the Cyber Resilience Act.

A note to forward to your team

Software bill of materials check against the 2026 minimum elements

The Cybersecurity and Infrastructure Security Agency published new minimum elements for a software bill of materials on 29 July 2026. They add hashes, licences, tool name, generation context and a signature.

Please run the query in this note on the record for [product and release] by [date] and reply with:
1. Components in the record
2. Components with a hash
3. Components with a licence
4. Generation context stated: [yes or no]
5. Record signed: [yes or no]

Owner: [name]
Note: https://stonetusker.com/insights/cisa-sbom-minimum-elements-2026.html