No. The NTIA minimum elements for an SBOM list seven baseline data fields: supplier name, component name, version, other unique identifiers, dependency relationship, author of SBOM data and timestamp. License is not among them. If investors or customers want licenses, add them as an extra field.
What the report says
The NTIA report, published by the US Department of Commerce on 12 July 2021 under Executive Order 14028, says the minimum elements enable basic use cases such as management of vulnerabilities, software inventory and licenses. It describes SBOM use for inventory, vulnerability and license management by producers and operators, and risk evaluation of both license and vulnerability by purchasers. It also says SBOMs help a producer know and comply with license obligations.
So licenses are a named benefit of SBOMs, but the baseline data table does not require a license field. The report also lists automation support and practices and processes as part of the minimum elements, alongside the data fields.
Where to put the license
SPDX 2.3.1 gives each package a concluded license field and a declared license field. The concluded field holds a valid SPDX License Expression, or NONE if the creator concludes there is no license, or NOASSERTION in the defined cases. If you use another format, check its field names rather than assuming they map one to one.
| Field state | Meaning in plain words |
|---|---|
| Expression | The license we conclude applies |
| NONE | We concluded there is no license |
| NOASSERTION | We could not or did not determine it |
For more on the difference between NONE and NOASSERTION, see NOASSERTION vs NONE in SBOM license fields.
What to tell a requester
When a buyer says "we need an SBOM that meets the minimum elements," you can truthfully deliver one without license data. When they also ask for licenses, say that the minimum elements do not cover it and offer the extra field. Telling them clearly avoids confusion later.
Checklist for an SBOM with licenses
- Include the seven baseline fields.
- Add a license field per component, with SPDX identifiers.
- Use NOASSERTION honestly, and track the unresolved ones.
- Add the generation timestamp and the tool.
- Regenerate per release.
See also license fields to require in a supplier SBOM.
Try it yourself
Open the demo and notice which columns are identity fields and which are extra. License is the kind of column you add.
Click through it at your own pace, or open it full screen.
Safeguard offers SBOM and dependency scanning, and a free scan at gold.safeguard.sh/scan to see a component list for your project.
Quick check
Is the license field mandatory in the NTIA baseline?
No. The seven fields do not include license. The report does name license management as a use case.
Is NOASSERTION a failure?
It is a valid value when the creator could not determine the license. Track those entries until they are resolved.
Sources
Last reviewed: 19 October 2026.
