SPDX is an open standard for sharing software bill of materials data. It describes where software came from, its licensing, its security, and related facts. It is hosted by the Linux Foundation and recognized internationally as ISO/IEC 5962:2021, which gives buyers a standard they can name in contracts.
What the name stands for
SPDX stands for Software Package Data Exchange. The idea is a common format, so a supplier and a customer who use different tools can still pass an inventory back and forth without converting it by hand.
What it can describe
The SPDX project says the standard covers provenance, licensing and security details. That mix reflects its history: it grew from a need to record software licenses accurately, then widened to cover the wider supply chain questions.
For an SBOM, that means each component entry can carry:
- an identifier and version
- the license information
- relationships to other components
- security related references
Exactly which fields appear depends on the SPDX version and on what the generating tool filled in.
Why the ISO number matters
Being an ISO/IEC standard gives procurement teams something concrete to cite. If a contract says "provide an SBOM in an internationally standardized format," SPDX satisfies that wording. That does not make it the only valid choice.
SPDX or CycloneDX
Both are widely supported, and many tools export either. A short way to choose:
- If your buyers or regulators name a format, use that one.
- If license compliance is your main driver, SPDX's licensing roots are a natural fit.
- If you want one format for components, services and vulnerabilities, compare it with CycloneDX.
You are not locked in. Keep your source data in a form you can export to either, and test that a second tool can read what you produce.
Check what you generate
A file that claims to be SPDX is not automatically complete. Validate it, and look at whether transitive dependencies and versions are present. A well-formed file with half the components missing is worse than no file, because people trust it.
Safeguard ingests SBOMs and scans the components they list. A free scan is at gold.safeguard.sh/scan.
Quick check
Is SPDX only about licenses?
No. It began with licensing, but the project describes it as covering provenance, licensing and security details.
Is SPDX the same as an SBOM?
No. An SBOM is the inventory. SPDX is one standard format for writing it down.
Sources
Last reviewed: 19 October 2026.
