The Cybersecurity and Infrastructure Security Agency (CISA) is requesting public comment on its 2025 Minimum Elements for a Software Bill of Materials (SBOM) draft update, which aims to reflect the current maturity in software transparency and supply chain security. This update builds upon the 2021 NTIA SBOM Minimum Elements to help agencies and organizations more effectively manage software risk.

The draft document, published August 22, 2025, is intended to guide SBOM implementation for U.S. federal departments and agencies, but is also applicable to other organizations — especially medical device manufacturers. It emphasizes that SBOMs provide a detailed inventory of software components, enabling organizations to identify vulnerabilities, assess risk, and make informed decisions. Automation remains a critical aspect for driving security at scale.

Summary of the 2025 draft update: the document introduces several additions and updates to the baseline data fields, practices, and processes for SBOMs. The minimum elements outlined apply to all software acquired or developed by agencies, including open-source, AI software, and software-as-a-service (SaaS). It refines how the federal government should generate and request SBOMs, without creating new federal requirements.

Why medical device manufacturers should care: the FDA has specifically used the 2021 NTIA SBOM Minimum Elements as input into its cybersecurity premarket guidance on how manufacturers should generate SBOMs for submission packages and for later sharing with customers. The final release of this updated document is likely to be adopted by FDA as the expected format for SBOMs included in submissions. See our FDA submission documentation guide for what’s currently expected.

Key updates and additions

New data fields:

  • Component Hash — the cryptographic value generated from the software component.
  • License — information on the license(s) under which the software component is available.
  • Tool Name — identifies the software tool(s) used by the SBOM author to generate the SBOM.
  • Generation Context — insight into the software lifecycle phase (before, during, or after build) when the SBOM was generated.

Major updates to existing data fields:

  • SBOM Author clarified as the entity creating the SBOM data, distinct from the Software Producer.
  • Software Producer replaces “Supplier Name” to identify the originator or manufacturer of the software component, allowing for multiple entries.
  • Component Version allows substitution of the file creation date if no version is provided by the producer.
  • Software Identifiers now require at least one identifier, preferring machine-processable and unique identifiers like CPE and PURL, explicitly mentioning OmniBOR and SWHID.
  • Dependency Relationship now requires explicitly documenting pedigree for backported or forked software.
  • Coverage replaces “Depth,” now defining coverage as including horizontal breadth (in addition to vertical breadth) — all components and their transitive dependencies, with no minimum depth.
  • Known Unknowns clarifies the distinction between information that is unknown to the author versus purposefully redacted due to contractual obligations.
  • Accommodation of Updates to SBOM Data replaces “Accommodation of Mistakes,” focusing on accommodating updates rather than corrections.

Removed: the “Access Controls” element is removed as a standalone requirement, with access control considerations now incorporated into “Distribution and Delivery.” SWID was also removed from the list of widely used data formats, while SPDX and CycloneDX are retained. Timestamps are now expected to adhere to ISO 8601 for better automation and interoperability.

How this compares to prior CISA publications

2021 NTIA SBOM Minimum Elements — the 2025 draft explicitly updates and clarifies the 2021 NTIA document. Most of the changes above are direct revisions to the 2021 elements:

  • The Supplier Name element from 2021 is replaced by Software Producer, considered less ambiguous and better aligned with the entity that originated the software.
  • Component Hash, License, Tool Name, and Generation Context are entirely new minimum elements, recognizing their importance for risk-informed decisions and improved data quality.
  • The shift from “Depth” to “Coverage” for dependencies signifies a more mature understanding — moving beyond top-level dependencies to a comprehensive horizontal and vertical breadth.
  • The “Known Unknowns” clarification addresses ambiguities stakeholders raised since 2021, distinguishing truly unknown data from purposefully redacted information.
  • Removing “Access Controls” as a separate element reflects the evolution of SBOM sharing practices, folding access considerations into distribution and delivery.
  • The change from “Accommodation of Mistakes” to “Accommodation of Updates to SBOM Data” signals an expectation of higher data accuracy and a focus on keeping information current, rather than correcting frequent errors.

Framing Software Component Transparency (Third Edition, 2024) — this community-driven workstream, adopted by CISA, already discussed many of the 2025 draft’s “new” elements as Baseline Attributes or Recommended Practices:

  • Cryptographic Hash appears as a Baseline Attribute with minimum expected maturity levels.
  • License and Copyright Notice were added as Baseline Attributes in the 2024 document’s updates.
  • Identifying tool(s) and version(s) is recommended as a “Recommended Practice” under the Author Name attribute.
  • ISO 8601 timestamp format is already specified.
  • The concept of different SBOM Types (similar to “Generation Context”) created at various lifecycle points — design, source, build, deployed — is already discussed.
  • The document provides maturity levels (Minimum Expected, Recommended Practice, Aspirational Goal) for many attributes, charting an evolutionary path for SBOM content.

The 2025 CISA draft effectively raises the “Minimum Expected” baseline for official government requirements, formalizing many aspects the 2024 Framing document had treated as recommended or aspirational. The Framing document itself acknowledges NTIA’s 2021 Minimum Elements and CISA’s authority to update it, and also references NTIA’s “Roles and Benefits for SBOM Across the Supply Chain” for perspectives like “Chooser” and “Operator” — perspectives the 2025 CISA document also cites.

In essence, the 2025 CISA draft represents a significant formalization and elevation of SBOM requirements, drawing on the practical experience and community-driven advancements documented in the “Framing Software Component Transparency” work to update the foundational 2021 NTIA Minimum Elements.

Reference: CISA — 2025 Minimum Elements for a Software Bill of Materials (SBOM)