In brief: CISA expands SBOM minimum elements with new data fields such as hash values, licenses, and author signatures to enable organizations better software supply chain transparency.
The U.S. agency CISA has published a revised guidance for Software Bill of Materials (SBOM) in collaboration with international partners, replacing the five-year-old 2021 version. The new edition incorporates more than 90 responses from public consultation and substantially expands the required data elements.
The new guidance “2026 Minimum Elements for a Software Bill of Materials” is based on the minimum elements published by NTIA in 2021 and adapts them to current technical standards. An SBOM serves as a structured ingredient list for software, enabling organizations to maintain an accurate inventory of all software components in use.
The revised version retains the core principles of its predecessor but expands the range of covered use cases and improves data quality. Newly included are the hash algorithm and hash value of components, license information, author signatures, name and version of the data format, the creation context, as well as name, version, and designation of the SBOM tool used. Only two elements were removed: access control and Software Identification Tags. Several elements were revised or restructured – for example, the component name, which will now allow multiple entries.
According to the participating agencies, the SBOM tooling environment has developed significantly since 2021, enabling organizations today to require substantially more detailed information about their software supply chain than five years ago. This data allows CISOs to better understand their software supply chain and make more informed risk management decisions – for example, when dealing with known or newly discovered vulnerabilities.
The updated guidance addresses software in general, though certain software types such as AI systems or Software-as-a-Service may require additional components. G7 government agencies had already published a specialized SBOM guidance specifically for AI systems in May.
Source: www.it-daily.net · Published 30 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.