The seven NTIA minimum data fields map to named fields in both formats. Supplier, component name, version, other identifiers, dependency relationship, author of SBOM data and timestamp each have a home in CycloneDX and in SPDX, though the field names differ. The table below shows the mapping that follows from the specs.
The seven fields
NTIA's 2021 report lists these baseline data fields: Supplier Name, Component Name, Version of the Component, Other Unique Identifiers, Dependency Relationship, Author of SBOM Data and Timestamp.
Crosswalk
| NTIA field | CycloneDX 1.6 | SPDX 2.3 |
|---|---|---|
| Supplier name | component supplier | PackageSupplier |
| Component name | component name (and group) | PackageName |
| Version | component version | PackageVersion |
| Other unique identifiers | purl, cpe, swid, omniborId, swhid | ExternalRef lines |
| Dependency relationship | dependencies with dependsOn | Relationship lines such as DEPENDS_ON |
| Author of SBOM data | metadata tools or authors | Creator |
| Timestamp | metadata timestamp | Created |
The CycloneDX component fields come from the 1.6 JSON reference, where supplier is described as the organization that supplied the component, which may be the manufacturer, a distributor or a repackager. The SPDX fields come from clauses 6, 7 and the relationships section of the 2.3.1 spec.
Notes on each
Supplier. In SPDX the field is optional and may be NOASSERTION. In CycloneDX it is optional too. NTIA still lists it as a minimum element, so a file can be valid for the format and still fall short of the minimum. That gap is common.
Identifiers. NTIA says these exist to map data across ecosystems and lists CPE, SWID and purl as examples, to be used if they exist.
Dependency relationship. NTIA describes it as the directional aspect of inclusion, enabling transitivity from software to a component and sub-component.
Author. NTIA says this is the source of the metadata, not the author of the software. In SPDX that is Creator, which may be a person, organization or tool.
Timestamp. NTIA defines it as when the data was assembled. SPDX Created is a UTC timestamp.
Validate against the minimum, not just the schema
Schema validation answers whether a file is well formed. A minimum elements check asks whether every component has a supplier, name, version and an identifier, whether relationships exist, and whether author and timestamp are present. Run both. Many files pass the first and fail the second.
A simple check: for each component, count how many of the first four fields are filled. Report the percentage by field. A supplier fill rate under half tells you what to ask producers for.
One caution
NTIA published the 2021 report as the baseline. Newer guidance from other bodies may ask for more, so check the current text from whichever authority your customer follows. This post covers the 2021 elements only.
Safeguard can generate SBOMs and run dependency scanning across your repositories, so the fields discussed here are checked on real projects instead of by hand. You can try the free scan at gold.safeguard.sh/scan.
Try it yourself
Open the demo, click through the component list, and look at how each package is identified and what is missing.
Click through it at your own pace, or open it full screen.
Quick check
Does a valid CycloneDX file meet the NTIA minimum?
Not automatically. The schema makes few of these fields mandatory, so a valid file can still lack supplier or identifiers.
Which fields does the NTIA report recommend beyond the seven?
It lists recommended fields such as hash of the component and lifecycle phase.
Sources
- NTIA, The Minimum Elements for a Software Bill of Materials (2021)
- CycloneDX 1.6 JSON reference
- SPDX 2.3.1, Clause 7: Package information
- SPDX 2.3.1, Clause 6: Document creation information
Last reviewed: 19 October 2026.
