NOASSERTION says "I am not making a statement": the creator could not determine the answer, made no attempt, or chose to give no information. NONE says "there is nothing here": a definite statement that no value exists. In an SBOM they are very different claims.
NOASSERTION in detail
The SPDX 2.3.1 specification uses NOASSERTION when the creator tried and could not reach a reasonable determination, did not try, or deliberately provided no information. The spec says no meaning should be read into the deliberate case. For concluded license, a missing field is treated as equivalent to NOASSERTION.
So a reader who sees NOASSERTION should conclude only that the SBOM author did not say.
NONE in detail
NONE is a positive statement. Examples from the spec:
- For download location, NONE means no location exists at all.
- For concluded license, NONE means the creator concludes that no license is available.
- For declared license, NONE means the package contains no license information.
Those are real findings. A package with no license is a legal risk, and the SBOM is telling you so.
The mistake people make
Teams often write NONE when their tool found nothing. Finding nothing is not the same as there being nothing. If your scanner did not look for licenses in a vendored directory, the honest value is NOASSERTION. Writing NONE tells a downstream license review that the package has no license information, which may send someone on a false chase or hide a real problem.
A quick rule
Ask yourself: "Would I be willing to defend that nothing exists?" If yes, NONE. If the honest answer is "we did not determine it," NOASSERTION.
Where you will see them
Download location is a required field in SPDX, so it is common to see one of the two there when no URL applies. License fields and supplier use NOASSERTION as well. The supplier field accepts NOASSERTION, a person, or an organization.
What buyers should do
Count NOASSERTION values per field. A few are normal. Large numbers in license fields mean the license picture is incomplete, and you should ask the supplier for more. Large numbers of NONE in license fields deserve a close look, because they are a claim that the package carries no license.
Also see how to mark unknowns in an SBOM for the cross format view.
Quick check
My scanner found no license. Which value?
Usually NOASSERTION, unless you checked and can state that no license exists.
Is a missing concluded license field a problem?
The spec treats a missing concluded license as equivalent to NOASSERTION, so it reads as "not stated."
Sources
Last reviewed: 19 October 2026.
