Software Bill of Materials(SBOM)

A Software Bill of Materials (SBOM) lists every component that makes up a piece of software: direct dependencies, their transitive dependencies, versions, and licenses. It answers a question that used to require manual auditing: if a vulnerability is disclosed in a library, which of our products actually include it, and where?

Why SBOMs became a regulatory requirement

SBOM requirements moved from a supply-chain security best practice to binding policy quickly, driven mostly by software supply-chain incidents where a compromised or vulnerable dependency was buried too many layers deep for anyone to notice until after exploitation. The US Executive Order 14028 (2021) required SBOMs for software sold to federal agencies, and the EU's Cyber Resilience Act carries a similar expectation for products sold in the EU market.

The standard machine-readable formats are CycloneDX (maintained by OWASP) and SPDX (maintained by the Linux Foundation), and most SBOM tooling in production today generates one of the two.

Why it is the model for CBOM

A Cryptographic Bill of Materials (CBOM) is not a coincidence of naming. It applies the exact same idea, a structured, machine-readable inventory, to a narrower and different question: not "what software components exist," but "what cryptographic algorithms, key lengths, and protocols are actually in use, and where."

CycloneDX extended its existing SBOM specification to natively support CBOM data, so an organization that already generates SBOMs as part of software supply-chain compliance can extend the same tooling and the same document format to cover cryptographic inventory, rather than standing up a separate process from nothing.

Why it appears on this site

Several jurisdictions scored on this tracker frame their cryptographic inventory requirement as an extension of an existing SBOM or software supply-chain security obligation, rather than inventing a CBOM mandate from scratch. Where a country's regulator makes that link explicit, it materially affects how concrete and enforceable the requirement actually is, which this tracker's inventory-requirement axis accounts for.