Federal agencies replaced a five-year-old baseline for software component inventories, extending it to cover open source, AI systems, and software-as-a-service.

 

What happened

CISA, the National Security Agency, the FBI, and fifteen international partner agencies released updated guidance on July 29, 2026, titled 2026 Minimum Elements for a Software Bill of Materials, according to CISA. The document replaces the minimum elements the National Telecommunications and Information Administration published in 2021, which had served as the reference point for what an SBOM should contain. A software bill of materials is an inventory of the components inside a piece of software, comparable to an ingredients list, and it lets an organization determine whether a newly disclosed flaw affects anything it runs. The revision incorporates more than 90 comments submitted during a 2025 public comment period. Its scope now covers all software, including open-source code, artificial intelligence systems, and software delivered as a service.

 

Going deeper

Ten data fields join the baseline, and several address problems that surfaced once organizations began using SBOMs at scale rather than producing them for compliance. Component Hash Algorithm records the cryptographic fingerprint of each component, which lets a recipient verify that what arrived matches what the producer listed rather than taking the inventory on trust. Component License captures the terms attached to each piece, a gap that made legal review of open-source dependencies awkward under the older format. SBOM Tool Name and SBOM Generation Context document how the inventory was produced and at what point in the build process, since an SBOM generated from source differs from one generated after packaging and the two can disagree. The guidance is published as a joint Cybersecurity Information Sheet rather than a regulation, so it carries no independent enforcement weight, though procurement requirements across government and industry routinely point at it.

 

What was said

"We want the SBOM minimum elements to paint a modern, comprehensive supply chain security picture," said Chris Butera, CISA Acting Executive Assistant Director for Cybersecurity, in the agency's announcement on July 29, 2026. He credited the public comments with shaping the revision and framed the update as tracking how far SBOM adoption has come since 2021. The NSA published the guidance simultaneously as a joint Cybersecurity Information Sheet.

 

In the know

AI systems fall within scope without receiving fields of their own, an omission the document addresses by pointing elsewhere. CISA and the Group of Seven partners issued separate guidance in May titled Software Bill of Materials for AI, and the 2026 minimum elements treat it as supplemental rather than folding AI-specific requirements into the general baseline. The reasoning is that an AI system is still software but carries artifacts a conventional inventory was never designed to describe, including models, training datasets, and weights. Those artifacts also break an assumption built into SBOM tooling, since a model or dataset can change without any build process running to trigger regeneration of the inventory. Organizations tracking AI components need a refresh trigger that does not depend on a code build.

 

The big picture

Healthcare organizations sit on the receiving end of this guidance more often than the producing end, and one sector requirement already turns on it. Section 524B of the Federal Food, Drug, and Cosmetic Act obliges manufacturers of cyber devices to provide a software bill of materials covering commercial, open-source, and off-the-shelf components in premarket submissions, and the FDA has been able to refuse submissions lacking one since October 2023. Hospitals therefore receive SBOMs for newer connected devices whether or not they have built any process for reading them. The value only appears when a flaw is disclosed, and someone can answer which infusion pumps, imaging systems, or monitors contain the affected component, which is the question that decides whether an unpatched dependency becomes a route for ransomware. Biomedical engineering and IT security teams generally maintain separate inventories, and the practical first step is agreeing which of them owns the SBOM file when it arrives with a purchase order.

 

FAQs

What formats do SBOMs use?

The two widely adopted machine-readable standards are SPDX, developed under the Linux Foundation, and CycloneDX, maintained by OWASP. Both encode the same categories of information in different structures, and most tooling can convert between them, though field-level fidelity is not always preserved in translation.

 

Does an SBOM tell you whether a vulnerability is exploitable?

No. It records which components are present, not whether a flaw in one of them can actually be reached in that product's configuration. A companion artifact called VEX, for Vulnerability Exploitability eXchange, carries that assessment, and the FDA has begun requesting VEX files alongside SBOMs in some premarket submissions.

 

Are hospitals required to collect SBOMs from vendors?

No federal rule obliges a healthcare provider to collect them, though the proposed HIPAA Security Rule update would require a technology asset inventory and network map, which SBOM data supports. Many health systems now request SBOMs contractually during procurement regardless.

 

What happens when a component in a device reaches the end of support?

The component stops receiving security fixes while the device remains in clinical use, which is why FDA guidance asks manufacturers to address support and end-of-support levels. Organizations should treat an approaching end-of-support date on a component as a planning trigger rather than waiting for a vulnerability announcement.

 

Does an SBOM need updating after the software ships?

Yes, whenever components change through patches, updates, or configuration changes that alter dependencies. A static inventory produced once at release drifts out of accuracy quickly, which is the reason the new guidance records how and when each SBOM was generated.