CycloneDX is a modular, extensible framework for representing supply chain information such as components, services, dependencies, vulnerabilities and cryptographic assets. It was developed by the OWASP Foundation and Ecma International, and it is published as ECMA-424 under Ecma's TC54 technical committee.
More than a component list
Many people meet CycloneDX as an SBOM format, and it does that job. The project also lists support for SaaSBOM, which covers services, and HBOM for hardware. The same framework can also carry vulnerability information and cryptographic assets.
That breadth is the main reason teams pick it. One document structure can hold the SBOM and related context, instead of stitching several formats together.
What modular means in practice
A tool can include only the parts it knows. A basic file may list components and their versions. A richer one adds dependency relationships, services the software talks to, or vulnerability status. Readers use the parts they understand and skip the rest.
Extensibility cuts both ways. Two valid CycloneDX files can differ a lot in how much they say, so agree with your counterparty on what must be present, not just on the format name.
Choosing between formats
CycloneDX and SPDX are both standardized and widely supported. A practical approach:
- follow whichever your customer or regulator names
- prefer the one your existing tools export most completely
- confirm that your vulnerability and license tools can read it
If you can, generate from source data that can produce either. Switching formats later then becomes an export setting.
Quality checks before you share a file
- Validate it against the schema.
- Spot check a few components against the real dependency tree.
- Make sure transitive dependencies appear.
- Use stable identifiers such as purls so other tools can match components reliably.
Safeguard reads SBOMs from supported formats and scans the components they list. A free scan is at gold.safeguard.sh/scan.
Quick check
Who maintains CycloneDX?
The project describes it as developed by the OWASP Foundation and Ecma International, with the standard published as ECMA-424.
Can CycloneDX describe things other than software?
Yes. The project lists SaaSBOM for services and HBOM for hardware in addition to software SBOMs.
Sources
Last reviewed: 19 October 2026.
