The Cybersecurity and Infrastructure Security Agency and 17 other U.S. and international organizations have released the 2026 Minimum Elements for an SBOM, replacing the National Telecommunication and Information Administration’s (NTIA) 2021 baseline and expands the minimum data fields from seven to 17.
The additions include digital signatures, component hashes, licensing information and records of how the software bill of materials (SBOM) was generated.
The baseline applies to all software, including open-source software, artificial intelligence systems and software delivered as a service. It establishes information that producers can supply and procuring organizations can request, but creates no new legal or regulatory requirement.
An SBOM is a formal record of the components used to build software and the supply-chain relationships among them, according to the National Telecommunications and Information Administration (NTIA). In practical terms, it is an inventory of what is inside a software product.
However, an SBOM does not, by itself, establish that every component has been identified or recorded correctly. The new guidance expands the information such inventories should contain but leaves confirmation of their accuracy, coverage and completeness outside the baseline.
Expanding the minimum data fields
The 10 new fields cover the SBOM author’s digital signature, the data format and its version, the generation context, the tool and tool version used, the document version, component hashes, the hash algorithm and licensing information.
CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said the agency wanted the revised minimum elements to “paint a modern, comprehensive supply chain security picture.” The additions provide more information about where an inventory came from, how it was produced and which executable artifact a component record corresponds to.
Tracking transitive dependencies
The expanded coverage goes beyond the top-level dependency expectation described in the 2021 baseline. The new document calls for “all components that make up the target software, including transitive dependencies” and sets “no minimum depth.” Separate instances with different metadata should be recorded separately, although linked SBOMs can provide the underlying component information when recipients can access all linked documents.
Each software version or update should also have an associated inventory. When a required field is not provided, the SBOM author should state whether the information is unknown to the author or has been withheld.
Organizations may consider an inventory incomplete when essential component data is withheld. The guidance directs organizations to address coverage, corrections, delivery, frequency and withheld information in policies or contracts used to request or provide SBOMs.
Limits on validation and completeness
The author-signature field aims to provide assurance that the claimed signatory signed the SBOM and that its information was not modified afterward. A component hash value is generated from an executable artifact, while the named algorithm allows the artifact’s integrity to be checked.
Neither element validates the inventory as a whole. The joint guidance places confirmation of “accuracy, coverage, and completeness” outside the minimum elements because those properties involve different quality measures and assurance expectations.
Independent testing has shown why completeness may require separate verification. A 2023 IEEE Security & Privacy study ran six SBOM-generation tools across 26 open-source Java projects and found that they could produce different dependency sets for the same project. The study did not assess the 2026 fields, and its results are limited to the selected Java projects and tool versions.
Federal rules for cloud and SaaS
A Jan. 23, 2026, Office of Management and Budget memorandum allows federal agencies to adopt contract terms requiring producers to supply a current SBOM on request. For cloud platforms, agencies adopting such terms should specify that the request covers the runtime production environment. The memorandum does not require agencies to use the terms and refers to CISA’s 2025 draft, which preceded the final July guidance.
For SaaS, the guidance identifies a delivery problem: delivering and receiving SBOMs as frequently as cloud software changes may overwhelm producers and operators. APIs can accommodate rapid code changes by capturing snapshots from continuous-integration and continuous-delivery processes.
AI guidance and future work
The general baseline adds no AI-specific fields and instead points to separate AI SBOM guidance issued by CISA and G7 partners in May. The earlier guidance sets out minimum information for AI systems, models, datasets and infrastructure. The guidance identifies four areas for further work: cloud software including SaaS, AI software, validation and correlation with security advisories.