Run this check before any SBOM leaves your company. It follows the 17 data fields in CISA's 2026 minimum elements as reported: seven carried over from 2021 and ten new. Tick each one, and write down any you cannot fill.
SBOM level fields
- SBOM author. The entity that produced the SBOM, not a tool name.
- SBOM timestamp. Reporting says it must follow RFC 9557.
- SBOM version. Increment when the file changes.
- Data format name. For example CycloneDX or SPDX.
- Data format version. For example 1.7.
- Tool name. The generator.
- Tool version. The exact version.
- Generation context. How and from what it was made. See generation context.
- Author signature. Sign, or say that you do not.
Component level fields
- Component name. Alternate names are allowed as multiple entries.
- Component producer. Formerly supplier name. Mark unknown provenance.
- Component version. Mark unknown if the producer gave none.
- Component identifiers. At least one machine processable identifier each. A purl is a common choice.
- Dependency relationship. A component necessary for the operation of another. Include transitive dependencies.
- Hash value.
- Hash algorithm.
- Component license.
The field names above come from one secondary source, so verify the exact names and count in the CISA PDF before you certify compliance to anyone.
Practices to check as well
- Depth: no minimum, so include transitive dependencies.
- Unknowns marked, not guessed.
- Any redacted data has a process for recipient questions.
- Secrets removed from URLs and paths.
- Delivery: a secure channel and a plan for updates.
What to do with gaps
List them in the cover note. A buyer reading "hashes are provided for most components, listed ones are missing" is better served than one who assumes completeness. If you quote a percentage, quote one you measured.
After sending
Set a refresh schedule. An SBOM is a snapshot, and the 2026 guidance, as reported, focuses on keeping information current.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM and dependency scanning can help you produce and keep an inventory current, and you can try a free scan at gold.safeguard.sh/scan.
Quick check
Do I need all fields for every component?
That is the baseline. Where a value is genuinely unknown, mark it unknown rather than guessing.
Sources
- FOSSA, CISA releases 2026 minimum SBOM elements
- CISA, 2026 Minimum Elements for a Software Bill of Materials
Last reviewed: 19 October 2026.
