United States (federal) · guidance
SBOM: what it requires, and the records to keep
An SBOM is a machine-readable list of a software product's components, versions, producers and dependencies. CISA's 2026 Minimum Elements, issued with NSA, FBI and 15 international partners, replaced NTIA's 2021 baseline and expanded it to 17 data fields covering all software, including AI software and SaaS.
01 / What it requires
What SBOM requires
Software producers selling to federal agencies or regulated buyers, and organizations that procure or operate software.
- 01Produce SBOMs with the 17 minimum data fields, including component producer, version, identifiers, hash value and license.
- 02Record SBOM author, timestamp, tool name and version, and generation context (lifecycle phase).
- 03Sign the SBOM so recipients can confirm it is unaltered (SBOM Author Signature).
- 04Use machine-processable formats such as SPDX or CycloneDX and update the SBOM when components change.
- 05For federal cloud contracts with SBOM terms, provide an SBOM of the runtime production environment on request.
02 / AI work
Where it touches AI work
The 2026 baseline expressly covers AI software but adds no AI-specific fields; CISA and G7 partners issued separate AI SBOM minimum elements in May 2026 as a supplement.
03 / Dates
The dates that matter
EO 14028 calls for SBOMs in federal software security
NTIA publishes Minimum Elements for an SBOM
CISA publishes draft 2025 Minimum Elements for comment
OMB M-26-05 rescinds M-22-18; SBOMs optional by contract
CISA and G7 release SBOM for AI minimum elements
CISA-led 2026 Minimum Elements replace NTIA 2021 baseline
04 / Enforcement
Who enforces it
No general penalty. Federal agencies may require SBOMs by contract (OMB M-26-05); other mandates come from sector rules and foreign law.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Signed SBOM per release in SPDX or CycloneDX
- 02Component hash values and license identifiers
- 03VEX or vulnerability status statements tied to SBOM components
- 04Contract clauses requiring SBOM delivery on request
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What goes in an SBOM for a federal AI deployment?+
An SBOM lists the software components of the deployed system and how they relate. CISA's 2026 Minimum Elements (July 29, 2026), which replace NTIA's 2021 baseline and expressly cover AI software and SaaS, set 17 data fields, including component producer, name, version, identifiers, hash value and algorithm, license and dependency relationships, plus the SBOM author, signature, timestamp, tool and generation context. A separate CISA and G7 guide from May 2026 adds AI-specific elements. Agencies are not required to demand SBOMs; under OMB M-26-05 they may require one on request by contract. Read the full answer
SOURCES
Go back to the source
CISA, NSA, FBI and international partners (hosted by FBI IC3)
Office of Management and Budget
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: SBOM vs SLSA v1.0 · SBOM vs C-SCRM · SBOM vs SCITT · SBOM for defense AI workflows · C-SCRM · AI Citation Sanctions · Proctoring Fairness