Which SBOM minimum elements should you follow: 2021 or 2026?

Build to the 2026 CISA minimum elements. CISA says the document updates and replaces the 2021 NTIA baseline, and it grows the data fields from seven to 17. If a customer or contract still cites the 2021 list, you can meet both, because the 2026 fields include the older seven.

What changed in one paragraph

The 2021 list had seven fields: author of SBOM data, timestamp, component name, supplier name, version, other unique identifiers, and dependency relationship. The 2026 document keeps those, renames several, and adds ten more. Some are SBOM metadata, such as the SBOM version, tool name, tool version, data format name and version, generation context, and an author signature. Three are component data: hash value, hash algorithm, and license.

Supplier name becomes component producer. Other unique identifiers becomes component identifiers. The old access control element is gone, and its points moved into the distribution and delivery discussion.

Which one does your reader expect

Ask who will read the SBOM and what they cite.

• A buyer whose questionnaire says "NTIA minimum elements" wrote it against the 2021 list. A 2026 compliant SBOM satisfies it.
• A buyer who cites the 2026 document will look for hashes, licenses and tool details. A 2021 SBOM will fall short.
• A regulator or contract that names neither: pick 2026 and say so in your cover note.

The 2026 text describes information that producers can supply and buyers can request. Reporting on it does not describe a new legal requirement, so treat it as the common baseline rather than a rule. Check any contract wording that points to a specific version.

A practical migration path

1. Run your current generator and list which of the 17 fields it fills.
2. Fill the cheap gaps first: SBOM version, tool name and version, format name and version.
3. Add component hashes and licenses. These usually come from the package manager or from a scan step.
4. Decide how you will sign the SBOM, or document that you do not yet.
5. Write down how you mark unknown producers and versions, because the 2026 guidance expects them to be marked.

You can do steps one and two in an afternoon. Hashes and licenses depend on your tooling, so test a sample of components before promising full coverage.

A note on the 2025 draft

CISA published a draft in August 2025 with a comment period that ran to 3 October 2025. The 2026 document reflects that consultation. If you see the 2025 draft cited in older material, the 2026 text is the one to read now.

For a field by field review of an incoming file, see how to check a supplier SBOM against the minimum elements.

Quick check

Sources

• CISA, 2026 Minimum Elements for a Software Bill of Materials
• FOSSA, CISA releases 2026 minimum SBOM elements
• CISA, 2025 Minimum Elements draft

Last reviewed: 19 October 2026.