The software bill of materials idea has a short policy history. A US bill in 2014 failed, Executive Order 14028 on 12 May 2021 directed NIST and NTIA to issue guidance, and NTIA published minimum SBOM elements on 12 July 2021. Those elements fall into three categories: data fields, automation support, and practices and processes.
The steps
Following the Wikipedia article on the software supply chain and the one on Executive Order 14028:
- 2014. The Cyber Supply Chain Management and Transparency Act was proposed in the US. It failed, but it led to the Internet of Things Cybersecurity Improvement Act of 2017.
- 12 May 2021. President Biden signed Executive Order 14028, Improving the Nation's Cybersecurity. It directed NIST and NTIA to set guidelines for software supply chain management, including SBOMs.
- 12 July 2021. NTIA published minimum SBOM elements in three categories.
The three categories
Data fields. The facts recorded about each component.
Automation support. The SBOM should be machine readable and generated automatically. The article notes that software composition analysis tools can provide automatic generation.
Practices and processes. How an organisation requests, produces and uses SBOMs over time.
This post does not list the individual data fields, because the pages fetched for it do not state them. Read the NTIA document itself for the exact list.
What the data says about adoption
The Wikipedia article reports that surveys in 2023 found about 60 to 76 percent of enterprises asked suppliers for SBOMs or built them into procurement or risk processes. It also reports that a 2023 study of six Java SBOM generation tools found they often produced inaccurate results, including inflated dependency lists. And a 2025 survey of financial companies found 43 percent were actively producing SBOMs.
These come from a secondary summary, so check the underlying studies before quoting a number.
What to take from it
An SBOM is only as useful as it is accurate and current. A file produced once for a customer and never refreshed gives a false sense of coverage. Generate it in the build, store it with the release, and check it against new advisories.
Questions to ask before sending an SBOM
Before you share an SBOM with a customer, check what it covers: the whole product or one service, the build or the running image. Confirm it was generated from the release artifact, not from a developer machine. Note the date, and the tool and version that made it. State what it does not cover, such as vendored code or runtime downloads. A short cover note with these points builds trust, and it protects you if the customer later finds a gap, because you told them about it first.
Quick check
When did NTIA publish the minimum SBOM elements?
12 July 2021, according to the source cited below.
What are the three categories?
Data fields, automation support, and practices and processes.
Safeguard generates SBOMs and scans dependencies against new advisories, and you can start with a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
