Use compositions. CycloneDX lets you describe how complete each part of an inventory is, with values such as complete, incomplete, incomplete first party only, incomplete third party only, and unknown. It is the format's built in way to admit a gap instead of hiding it.
Why completeness needs saying
An SBOM reads as authoritative. A list of 400 components looks finished even if it came from a manifest and missed vendored code. CISA's type document warns that different SBOM types have blind spots: source SBOMs can miss platform libraries, and analyzed SBOMs can have omissions when tools cannot decompose a component. A reader cannot see those limits unless you state them.
The 2026 guidance, as reported, also says authors must explicitly mark unknowns, and a recipient may treat an SBOM as incomplete if essential component data is withheld.
The values
Per the CycloneDX specification overview, completeness in the aggregates can be one of:
- complete
- incomplete
- incomplete first party only
- incomplete third party only
- unknown
Use unknown when you do not know, which is different from incomplete, where you know there are gaps.
Where to apply them
Compositions can attach to the whole BOM or to specific components. A practical split:
- Your own first party code that you built from source: complete, if your tooling reads the full resolved tree.
- Third party libraries listed from a lockfile: complete for the declared tree.
- Bundled binaries, copied code or firmware blobs: incomplete or unknown.
That gives a reader a map of what to trust and what to question.
Be careful with complete
Complete is a strong claim. Use it only where you checked. If a legacy module could contain components your tool cannot see, say incomplete. Claiming complete and being wrong damages trust more than admitting a gap.
Pair it with a note
A one paragraph cover note should explain what the tool could not see and how the buyer can ask questions. This lines up with the guidance that authors provide a process for questions about withheld data.
What buyers do with it
They route their attention. Incomplete or unknown regions are where to ask for an analyzed SBOM of the artifact, or for a plain language description of what is inside. See which SBOM type to ask a supplier for.
Quick check
Is unknown the same as incomplete?
No. Incomplete means you know the inventory has gaps. Unknown means you cannot say either way.
Do I have to use compositions?
They are optional in the format, but they are the standard way to state completeness.
Sources
- CycloneDX specification overview
- Types of Software Bill of Material (SBOM) Documents, CISA PDF
- FOSSA, CISA releases 2026 minimum SBOM elements
Last reviewed: 19 October 2026.
