Go all the way down. Reporting on the 2026 CISA minimum elements says the guidance states "there is no minimum depth," which means transitive dependencies must be included. An SBOM that lists only the packages you declared directly will hide most of what you actually ship.
Direct versus transitive
A direct dependency is one your project asks for. A transitive dependency is one that your dependency asks for, and so on down the chain. You never chose the transitive ones, but they run in your product and can carry the vulnerabilities.
A manifest such as a package file lists direct dependencies. A lockfile usually records the full resolved tree with exact versions. That is why an SBOM built from the lockfile is deeper than one built from the manifest alone.
What the guidance allows
The same reporting says linked sub SBOMs are allowed only if the recipient can reach all the linked documents. In plain terms: you can point to another SBOM for a bundled component, but if your customer cannot open it, the depth is not really there.
How to test the depth of your own SBOM
- Pick one direct dependency that you know has its own dependencies.
- Search the SBOM for those children by name.
- Confirm the dependency relationships connect them, not just list them.
- Repeat for one dependency in each ecosystem you use.
- Compare the component count against a lockfile or package manager listing.
If the children are missing, the generator read your manifest instead of a resolved tree. Fix that before you share the file.
Where depth still runs out
Depth in an SBOM is limited by what the tool can see. CISA's type document notes that source SBOMs may miss platform libraries and plugins, and analyzed SBOMs depend on heuristics. Code copied into your repository by hand, and binaries without metadata, are common blind spots.
Mark these as unknown rather than leaving silent gaps. Our post on marking unknowns in an SBOM covers how.
Does deeper mean noisier?
More components means more potential findings. That is a prioritization problem, not a reason to cut depth. Reachability analysis helps separate vulnerable code that your application can call from code that it cannot. Safeguard offers reachability analysis alongside SBOM and dependency scanning.
Click through it at your own pace, or open it full screen.
Quick check
Can I list only direct dependencies?
Not if you want to meet the 2026 guidance as reported. It says there is no minimum depth, so transitive dependencies must be included.
What generates the deepest data, a manifest or a lockfile?
A lockfile, because it usually records the full resolved tree with exact versions.
Sources
- FOSSA, CISA releases 2026 minimum SBOM elements
- Types of Software Bill of Material (SBOM) Documents, CISA PDF
Last reviewed: 19 October 2026.
