CISA and Partners Release Updated 2026 Minimum Elements for Software Bill of Materials (SBOM)
CISA, NSA, FBI, and international partners have updated guidance on the minimum elements required for a Software Bill of Materials (SBOM), replacing 2021 guidance with new considerations for AI and cloud environments.
Government cybersecurity agencies from the United States and its international partners have jointly released updated guidance for the 2026 Minimum Elements for a Software Bill of Materials (SBOM). This new document, issued by CISA, the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI), supersedes the previous guidance published by the National Telecommunications and Information Administration (NTIA) in 2021.
The updated guidance incorporates feedback gathered from a public comment period held in 2025. It aims to reflect the current landscape of SBOM tools, technologies, and evolving industry needs, while still preserving the foundational principles established by the original NTIA document. The core purpose of an SBOM remains to serve as a comprehensive list of software components, akin to an "ingredients list" for any given software product.
SBOMs are recognized as a critical building block for enhancing software security and managing supply chain risks. By providing a detailed inventory of software components, organizations can gain a clearer understanding of their software's composition and the associated supply chain dependencies. This enhanced visibility empowers them to make more informed, risk-based decisions regarding software adoption and security posture.
The minimum elements outlined in the guidance define the baseline technologies and practices that any SBOM should encompass. This ensures a standardized approach to software transparency across the industry. While these minimum elements are designed to be universally applicable to all types of software, the guidance acknowledges that certain specialized software categories may necessitate additional considerations.
Specifically, the updated guidance highlights that software such as artificial intelligence (AI) systems and software-as-a-service (SaaS) offerings operating within cloud environments may require supplementary SBOM elements beyond the baseline. These additional elements are crucial for accurately capturing the unique complexities and dependencies inherent in these modern technological domains.
Despite these specialized considerations, the overarching message is that any initiative aimed at improving software transparency should commence with the diligent application of these minimum elements. This foundational step ensures a consistent and understandable baseline for software inventory, regardless of the software's specific function or deployment environment.
The collaborative effort underscores the growing importance of SBOMs in the global cybersecurity strategy. As software supply chains become increasingly complex and interconnected, standardized SBOMs are essential for identifying vulnerabilities, managing risks, and fostering trust in the digital ecosystem.