For new SBOM work, choose SPDX or CycloneDX. The 2026 CISA minimum elements, as reported, no longer mention SWID, and tell consumers to accept widely used formats and avoid deprecated ones. The 2021 baseline had named SWID tags alongside the other two.
What changed
Earlier guidance listed three formats that supported automation: SPDX, CycloneDX and SWID tags. Reporting on the 2026 document says SWID is no longer mentioned, and that consumers should accept widely used formats, SPDX or CycloneDX, and avoid deprecated ones. I could not fetch the CISA PDF text itself, so confirm the wording there before you quote it in a contract.
What this means in practice
If you only publish SWID tags, expect friction with buyers who cite the 2026 document. Their tools probably read SPDX and CycloneDX, since those are what the guidance points to.
If a legacy system requires SWID, you do not have to stop. Treat SWID as an internal or compatibility format, and publish an SPDX or CycloneDX SBOM as the external one.
A migration plan
- Inventory where SWID tags come from. Many come from installers or software asset tools.
- Identify which consumers read them.
- Choose SPDX or CycloneDX for external sharing. Our format comparison helps with that.
- Map the SWID fields you have to the new format. Name, version and producer map easily. Check the others one by one.
- Run both for a transition period, then retire the external SWID output.
Do not lose data in translation
Format conversion can drop fields that the target format cannot hold. After you convert, compare field counts and spot check components. The 2026 elements add hashes and licenses, so confirm those survive.
What about other formats?
Tool specific JSON outputs exist, but a buyer's tools may not read them. For an SBOM you intend to share outside your company, stick with the two widely used standards.
What this is not
This is not a statement that SWID tags are useless. They have uses in software asset management. The question here is only which format to use when sharing an SBOM that must meet a baseline.
Quick check
Did SWID disappear from the guidance?
Reporting says the 2026 document no longer mentions it. The 2021 baseline named it as a format that supports automation.
Which formats should I accept as a buyer?
SPDX and CycloneDX, per the reported guidance.
Sources
- FOSSA, CISA releases 2026 minimum SBOM elements
- CISA, 2026 Minimum Elements for a Software Bill of Materials
Last reviewed: 19 October 2026.
