Say that it is unknown. The 2026 CISA guidance, as reported, tells authors to mark components of unknown provenance and to mark a version unknown when the producer does not supply one. A visible unknown is useful to a reader. A guessed value is a hidden error.
Why guessing hurts
A made up version number can match the wrong vulnerability records. A made up supplier sends your customer to the wrong team. Either one makes the whole file harder to trust, because the reader cannot tell which values were measured and which were invented.
How SPDX marks unknowns
SPDX has two reserved values. NOASSERTION means the creator tried and could not reach a reasonable determination, made no attempt, or chose to give no information. NONE means the creator is stating that nothing exists. The distinction matters, so do not use NONE to mean "I do not know." The full difference is in SPDX NOASSERTION versus NONE.
For supplier, the SPDX package field accepts NOASSERTION, a person, or an organization. The spec says the supplier must be an organization or a recognized author, not a website.
How CycloneDX handles gaps
CycloneDX lets you describe completeness at a higher level using compositions, with aggregate values such as complete, incomplete, and unknown. Use that to tell the reader which parts of the inventory you do not claim to be complete. For individual component fields, check the schema for how a missing supplier or version is represented before relying on any default.
A simple rule set
- Never fill a field with a placeholder that looks real, like version 0.0.0 or a supplier named "unknown vendor".
- Use the format's own mechanism for unknown or missing.
- Add a short note in the SBOM or the cover message listing which components are unknown and why, for example vendored code or a binary with no metadata.
- Give recipients a way to ask. The 2026 guidance, as reported, expects authors to provide a process for questions about withheld or redacted data.
- Revisit unknowns on every release, since many can be resolved.
What buyers should do with unknowns
Count them. A small number of marked unknowns in a large SBOM is normal and honest. A file with none, from a legacy product with embedded binaries, is more suspicious than a file with a few. Ask about the large ones first.
Quick check
Is NONE the same as unknown?
No. In SPDX, NONE states that nothing exists. NOASSERTION is the value for unknown or not determined.
Can I leave the supplier blank?
Often you can, but an explicit marker plus a note is clearer. The 2026 guidance, as reported, asks authors to mark unknown provenance.
Sources
- FOSSA, CISA releases 2026 minimum SBOM elements
- SPDX 2.3.1 specification, package information
- CycloneDX specification overview
Last reviewed: 19 October 2026.
