Check which format they really need, then either generate it directly or convert and validate. Both SPDX and CycloneDX are widely used, and guidance says recipients should accept either. Say in the cover note if a file was converted, and never send a format you have not validated.
What the guidance says
The CISA 2026 minimum elements name SPDX and CycloneDX as the two data formats currently widely used to generate and consume SBOMs, and say organizations should accept any widely used, interoperable and machine processable format. They also say organizations should avoid accepting SBOMs for new software in deprecated versions of a format. So a customer who insists on one of the two is within normal practice, and a customer who insists on a deprecated version is asking for something the guidance discourages.
The 2021 NTIA report adds a practical note: many experts have said computers are good at format conversions, and it stresses interoperability and automated translation tools.
Decision steps
- Ask what the customer's tool reads. Many requests say "SPDX" because a form said so, when the tool reads both.
- Check your generator. Many tools can emit more than one format. Generating directly from the source of truth is usually cleaner than converting.
- If you must convert, convert once. Chains of conversions lose detail.
- Validate the output. Run the file through a validator for the target format and open it to check that components, versions and relationships survived.
- Check the 2026 fields. Confirm author, timestamp, tool, generation context, identifiers, hashes and licenses are still present. Formats may use different field names, which the CISA text allows.
- Say what you did. Note in the cover note that the file was converted, and from what.
Where conversion loses detail
| Risk | What to look for |
|---|---|
| Identifiers dropped | Package URLs or CPE values missing after conversion |
| Relationships flattened | Transitive dependencies lose their parent links |
| License data changed | License identifiers rewritten or blanked |
| Hashes lost | Hash values or algorithm names missing |
| Metadata reset | Author, tool or timestamp overwritten by the converter |
If any of these show up, regenerate from source in the requested format.
When to say no
If the customer requires a proprietary or deprecated format, say what you can offer and why. The NTIA report says standards using proprietary data formats should not be included, and the CISA text says deprecated versions should be avoided for new software. Offer a current version of an open format and a call with their tools team.
Try it yourself
Open the demo to see an inventory with direct and indirect components. After conversion, this is the structure you should still be able to see.
Click through it at your own pace, or open it full screen.
Quick check
Is SPDX or CycloneDX the better choice?
The guidance does not pick one. Both are named as widely used. Choose by what your customer's tools read. See choosing between them.
Do we need to tell the customer about a conversion?
Yes. It is a short sentence in the cover note and it helps them judge the file.
Safeguard's SBOM and dependency scanning supports producing the inventory in the first place, and the free scan lets you see a result on your own code.
Sources
- 2026 Minimum Elements for a Software Bill of Materials (SBOM), CISA and partners, 29 July 2026
- The Minimum Elements For a Software Bill of Materials (NTIA, 2021)
Last reviewed: 19 October 2026.
