Yes. CycloneDX is published as the Ecma standard ECMA-424, and SPDX links to ISO/IEC 5962:2021 as its international standard. That tells you the formats are stable and documented. It does not tell you that any particular file you receive is complete or accurate.
What the sources say
Ecma lists ECMA-424 as the CycloneDX Bill of materials specification, second edition, December 2025. It defines the CycloneDX v1.7 format as a structured way to represent detailed inventory of software and hardware components, and it covers services, dependencies, vulnerabilities, cryptographic artifacts, machine learning models, metadata, licensing and claims or attestations. The BOM is serialized in JSON.
On its specifications page, the SPDX project calls the specification an international open standard and links to ISO/IEC 5962:2021. The same page lists 3.0 as the current version, with 2.3, 2.2 and earlier versions available.
What standard status does and does not give you
| It gives you | It does not give you |
|---|---|
| A fixed, citable definition of fields | A guarantee a producer filled them in |
| A reason procurement teams can name a format | Proof the file matches the shipped build |
| Interoperability between tools | Quality of the underlying scan |
| Stable references for contracts | Coverage of every ecosystem |
A standard describes the container. Quality depends on the generator, the build context and the person who reviews the output.
How to use this in practice
- In a contract or questionnaire, name the format and version, for example CycloneDX 1.6 or SPDX 2.3, not just SBOM.
- State the serialization. CycloneDX supports JSON, XML and Protobuf per its overview page.
- Ask for a validation step. Schema validity is a floor, not a verdict.
- Separate format questions from content questions. Completeness, depth and freshness need their own wording.
- Keep a note of which edition you accepted, since standards get new editions.
Common confusion
Some people treat ECMA-424 as a different format from CycloneDX. It is not. It is the standardized text of the format at a given version. Another mix-up is assuming the newest version is the right one to request. Your tools and your customers' tools must read it, so check support before you demand it.
A third point: standard status of the format says nothing about legal requirements. Whether a regulation asks for an SBOM, and in which format, is a question for the text of that regulation and your counsel.
A worked example: writing the clause
Suppose you are drafting a short SBOM clause for a customer agreement. A vague version says that the supplier will provide an SBOM on request. That sentence leaves everything open. A better draft names the pieces the standards work gives you. This is a drafting illustration, not legal advice, and your counsel should review any contract text.
| Element | Vague wording | Specific wording |
|---|---|---|
| Format | An SBOM | CycloneDX or SPDX, with the version stated |
| Serialization | Not stated | JSON for CycloneDX, or the SPDX serialization you agree on |
| Validity | Not stated | Passes schema validation for the declared version |
| Scope | Not stated | Components shipped in the named release |
| Timing | On request | Within an agreed number of days of request |
The first three rows come straight from the standards context. ECMA-424 defines CycloneDX 1.7 and the BOM is serialized in JSON. SPDX has several versions, with 3.0 current and 2.3 and earlier listed as previous. Naming a version removes ambiguity about which edition governs.
Why the version matters
Standards get new editions. ECMA-424 is listed as a second edition from December 2025, and the CycloneDX overview lists 1.7 as the current version. SPDX lists 3.0 as current while many tools still emit 2.3. If a contract says solely CycloneDX, a supplier and a customer can each be right while sending and expecting different versions. A validator for one version may reject a file written for another.
What to check on receipt
- Read the version in the file header and compare it with the contract.
- Run a schema validator for that version.
- Parse the file with the tool your team actually uses.
- Check that component counts look sensible for the product.
- Look at the root component and see that it names the shipped product.
Passing the first three confirms the container. The last two begin to check content, which is where quality lives.
What a standard does not settle
It does not settle depth, such as whether transitive dependencies are included. It does not settle freshness, such as how recent the file is. It does not settle completeness, such as whether bundled or vendored code is listed. Each of those needs its own words in the agreement or the questionnaire.
Myth versus fact
Myth: if a format is an international standard, any file in that format is trustworthy. Fact: the standard describes how to write the file. A producer can write a valid file that omits half the components.
Myth: the newest version is always required. Fact: a version is just an agreement between sender and receiver. Choose one both sides can read.
Myth: a standard guarantees legal acceptance. Fact: regulations and contracts decide what is acceptable. Ask counsel when the question is legal.
A short policy for your own team
Decide which format and version you emit by default, which you accept from suppliers, and which you convert at intake. Write it in a page, review it twice a year, and link it from your supplier questionnaire.
Where Safeguard fits
Safeguard works with SBOMs and dependency scanning. If you want to see how a file you received reads in practice, the free scan at gold.safeguard.sh/scan is an easy place to start.
Try it yourself
Click through it at your own pace, or open it full screen.
Click into a few components and note how direct and transitive packages are separated.
Quick check
Is SPDX an ISO standard?
The SPDX specifications page states it is an international open standard and links ISO/IEC 5962:2021. Note that the ISO text covers a specific version, so check which one when you cite it.
Does a valid schema mean a good SBOM?
No. It means the file parses. Completeness and accuracy need separate checks.
Should a contract name the format version?
It is a good idea, because versions differ. Have counsel review the exact wording.
Sources
Last reviewed: 19 October 2026.
