SPDX or CycloneDX: which SBOM format should a non-engineer ask for?

Ask for either. SPDX and CycloneDX are both open standards for a software bill of materials, and good tools read both. SPDX began with license compliance and is an ISO standard. CycloneDX began in security and is an Ecma standard. What matters more is that the file is machine-readable and complete.

What is an SBOM, in one sentence?

A list of the parts inside a piece of software, with versions, so that when a flaw is announced in one part you can check whether you have it. Think of the ingredient list on food packaging.

What is SPDX?

SPDX is an open standard for sharing SBOM data, including origin, license and security information. It is hosted by the Linux Foundation, and it is recognized as ISO/IEC 5962:2021. The current version, according to the project, is SPDX 3.0.0 from April 2024, which introduced profiles including Security, Build, Dataset and AI. The project says it makes no legal interpretations of licenses, so it records license facts, not legal advice.

What is CycloneDX?

CycloneDX is a modular specification for supply chain information, developed by the OWASP Foundation and Ecma International and standardized as ECMA-424. Version 1.7 is listed as current. It covers software and also hardware, cryptographic assets and operational configurations. Its model includes components, services, dependencies, vulnerabilities and VEX, which is a way to say whether a known vulnerability actually affects a product.

How do they compare?

• Steward: SPDX is hosted by the Linux Foundation. CycloneDX comes from the OWASP Foundation and Ecma International.
• Formal standard: SPDX is ISO/IEC 5962:2021. CycloneDX is ECMA-424.
• Roots: SPDX began with license compliance. CycloneDX began with security and supply chain.
• Current version, per the project pages: SPDX 3.0.0 and CycloneDX 1.7.

Does the format matter to a buyer?

Less than people think. Government and procurement guidance generally asks for a machine-readable SBOM. We could not confirm from the CISA page we read that it names either format, so do not assume a requirement. Check the specific contract or regulation you are under.

What does matter: does the SBOM list transitive dependencies, does it include versions and supplier names, is it refreshed with every release, and can your tools open it?

What to do

1. Ask your vendor which formats they can deliver, and request both if the cost is low.
2. State in the contract that the file must be machine-readable and updated per release.
3. Check that the file lists nested dependencies, not only the top level ones.
4. Open the file with a validator before you accept it.
5. Pick one internal format for storage and convert the other, if you need to.
6. Keep every version you receive.

Where does Safeguard fit?

Safeguard generates and analyzes SBOMs in SPDX and CycloneDX. Its CLI validates files against both formats and can scan either.

What should you ask for in a first request?

Keep the request simple so a vendor can say yes. For example: "Please send a machine-readable SBOM for the current release of the product, in SPDX or CycloneDX, listing direct and transitive components with names and versions, and tell us how often you update it."

Then ask three follow-up questions. Is the file generated from the build, or written by hand? Does it list the supplier or origin of each component? Can you share vulnerability status statements, such as VEX, if a listed flaw does not affect the product?

Do not ask for both formats unless you have a reason. Doubling the request slows the vendor, and a file you cannot review properly is no better than none. Pick one, check it, and ask for more only if the first one has gaps.

If you need a person to explain a file to you, ask your security team to read it with you once. After that the pattern becomes familiar.

Quick check

Sources

• SPDX, About the project
• CycloneDX specification overview
• CISA, Software Bill of Materials
• Safeguard CLI documentation

Last reviewed: 18 October 2026.