India's CERT-In SBOM guidelines version 2.0: what they cover

CERT-In's Technical Guidelines on SBOM, QBOM and CBOM, AIBOM and HBOM, version 2.0 dated 9 July 2025, address government, public sector, essential services and software exporters. They list minimum SBOM data fields and encourage organizations to make SBOMs a standard part of procurement and development.

What the document is

The India Computer Emergency Response Team, under the Ministry of Electronics and Information Technology, published version 2.0 on 9 July 2025. It is a technical guideline. Its executive summary says departments and organizations "are encouraged to make the creation and provision" of SBOMs "a mandatory standard practice" in software procurement and development. That is encouragement, so check whether any specific procurement rule or sector regulator turns it into a requirement.

Section 2.2 names three audiences: software consumers, software developers, and system integrators or resellers. It recommends that government, public sector and essential service organizations include SBOM requirements in all software purchases, and that security teams include SBOM inventory in their vulnerability management workflow.

Five kinds of bill of materials

The document covers more than software:

• SBOM, for software components.
• QBOM and CBOM, quantum and cryptographic bills of materials.
• AIBOM, for artificial intelligence components.
• HBOM, for hardware.

Each has its own chapter with benefits and minimum elements.

The SBOM data fields

Table 5 lists the minimum elements in three groups. The data fields include component name, version, description, supplier, license, origin, dependencies, vulnerabilities, patch status, release date, end of life date, criticality, usage restrictions, checksums or hashes, comments, author of SBOM data, timestamp, executable, archive and structured properties, and a unique identifier.

Automation support names SPDX and CycloneDX. Practices and processes are frequency, depth, known unknowns, distribution and delivery, access control and accommodation of mistakes.

Note that this list is longer than the original 2021 NTIA baseline and includes vulnerability and patch status inside the SBOM. CISA's 2026 document keeps vulnerability data in separate advisories such as VEX. The two approaches differ, so check which one a buyer expects.

Roles and rules of thumb

The guideline says an SBOM consumer "must ask for complete SBOM" and a developer "must ensure that correct and complete SBOM is supplied." It says an SBOM should be created for every new software component release and updated for changes. It uses a worked scenario where a developer builds missing SBOMs for components whose suppliers never made one.

Using it as a supplier

1. If you sell to Indian government or essential service buyers, expect questions framed by this document.
2. Map your SBOM fields to Table 5 and note differences.
3. Be ready to supply separate hardware or cryptographic bills of materials if the product calls for them.
4. Document how you share SBOMs, as the document has a chapter on access control and sharing.

For a side by side with other regimes, see SBOM rules compared across the US, EU, Germany and India.

Try it yourself

Click through it at your own pace, or open it full screen.

Click through to see how one control maps to several frameworks, which is the same overlap you will find between SBOM guidelines.

Quick check

Sources

• CERT-In Technical Guidelines on SBOM, QBOM and CBOM, AIBOM and HBOM, version 2.0
• CISA 2026 Minimum Elements for an SBOM

Last reviewed: 19 October 2026.