Authoritative Guide to SBOM

Implement and Optimize use of Software Bill of Materials

DOWNLOAD GUIDE

Contents

Frontispiece

Preface

Introduction

Design Philosophy and Guiding Principles

Defining Software Bill of Materials

The Role of SBOM in Software Transparency

High-Level SBOM Use Cases

xBOM Capabilities

CycloneDX Object Model

BOM Identity

The Anatomy of a CycloneDX BOM

Serialization Formats

Lifecycle Phases

Use Cases

Inventory

Vulnerability Management

Enterprise Configuration Management Database (CMDB)

Integrity Verification

Authenticity

License Compliance

Outdated Component Analysis

Provenance

Pedigree

Foreign Ownership, Control, or Influence (FOCI)

Export Compliance

Procurement

Vendor Risk Management

Supply Chain Management

Composition Completeness and “Known Unknowns”

Formulation Assurance and Verification

BOM Coverage, Maturity, and Quality

NTIA Minimum Elements

SCVS BOM Maturity Model

SBOM Quality

Generating CycloneDX BOMs

Approaches to Generating CycloneDX SBOMs

Generating SBOMs for Source Files

Integrating CycloneDX Into The Build Process

Generating BOMs at Runtime

Generating BOMs from Evidence (from binaries)

Building CycloneDX BOMs Manually

Consuming CycloneDX BOMs

Leveraging Data Components

Establishing Relationships in CycloneDX

Component Assemblies

Service Assemblies

Dependencies

External References

Establishing Relationships With BOM-Link

Pedigree

Formulation

Evidence

Component Identity

Recommendations

Occurrences

Reachability Using Call Stacks

License and Copyright

Scenarios and Recommendations

General Guidance

Microservice

Single Application (monolith, mobile app, etc)

Multi- Product Solution

Multi- Module Product

Using Modified Open Source Software

SBOM as Resource Locator

SBOM in Release Management

Extensibility

CycloneDX Properties

CycloneDX Properties and Registered Namespaces

XML Extensions

Appendix A: Glossary

Appendix B: References