CISA's 2026 minimum elements replace Supplier Name with Component Producer, defined as the name of an entity that creates, defines and identifies components. CISA says Supplier Name proved ambiguous in practice, particularly around distributors. Only one organization should be named producer for a given component.
Why the change
Under the 2021 list, supplier could mean the company that wrote the code, the company that sold it, or the company that shipped it to you. CISA's text says the old element "has proven ambiguous in practice, particularly around distributors of software." It adds that some ambiguity will remain "until there is a consensus methodology for identifying entities that create software."
The new field points at the creator. CISA says it can help identify a point of contact for software security concerns, and that it helps distinguish components with the same name made by different producers.
Rules in the text
- Use the full name, not acronyms, unless the official name includes one.
- Name only one organization per component.
- Keep it distinct from SBOM Author, which is the entity that created the SBOM data. If you wrote the component and made the SBOM, the two can be identical. If a third party made the SBOM, they differ.
A footnote warns that "producer" is not the same as the EU term "manufacturer" in the Cyber Resilience Act. All manufacturers are producers, but not all producers are manufacturers.
Filling it for open source
For open source projects the field still matters. CISA says naming practices vary with how a project develops and distributes packages. Some ecosystems have conventions for naming producers through package managers. Otherwise, use the original project or the maintaining organization. If there is no clear indication, "explicitly indicate that the component is of unknown provenance to acknowledge the lack of traceability."
A practical rule:
- Take the producer from the package metadata where it exists.
- Fall back to the project's maintaining organization.
- If neither is clear, write unknown, and do not guess.
What to change in your pipeline
- Rename the field in any internal mapping from supplier to component producer.
- Check how your generator fills it. Some tools put the registry host or distributor in that spot.
- Spot check twenty components. If many are wrong, fix the source of the data.
- Keep the old name in your notes if a customer still asks for the NTIA supplier field.
For the overall change from the earlier list, see which minimum elements to follow. For handling gaps, see how to mark an unknown supplier or version.
Try it yourself
Click through it at your own pace, or open it full screen.
Open the inventory and check which entries show a clear producer and which would need to be marked unknown.
Quick check
Is component producer the same as the author of the SBOM?
No. The producer created the component. The author created the SBOM. They match only if the same entity did both.
What goes in the field when no one is clear?
State that the component is of unknown provenance, as CISA's text advises, rather than guessing.
Sources
Last reviewed: 19 October 2026.
