ENISA Technical Advisory for Software Bill of Materials

What it is

ENISA Technical Advisory for Software Bill of Materials, October 2026, TLP:CLEAR. It is non-mandatory guidance for organisations starting SBOM adoption, especially micro, small and medium enterprises. It was revised after a call for feedback (17 December 2025 to 23 January 2026, 67 contributions), the ENISA SBOM Adoption State of Play 2026 survey (9 June 2026), and a CRA Expert Group review (31 July to 11 September 2026). It excludes AI, hardware and cryptographic BOMs, and it offers no maturity framework.

How it works

Section 2.1.1 maps the data fields of BSI TR-03183 Part 2 (v2.1.0, per the cited link) to the U.S. CISA "2026 Minimum Elements for a Software Bill of Materials". The aim is an SBOM that satisfies both. Fields that line up directly include:

• Creator of the SBOM and SBOM Author
• Timestamp and SBOM Timestamp
• Component creator and Component Producer
• Component name and Component Name
• Component version and Component Version
• Other unique identifiers (CPE or purl) and Component Identifiers
• Hash value of the deployable component and Component Hash Value
• Distribution licences and Component License

The two sources differ in the following ways:

• BSI expects the SBOM creator as an email address, or a URL if none exists. CISA asks for the author's name.
• BSI recommends UTC timestamps.
• Only BSI lists SBOM-URI.
• Only CISA lists SBOM Version, SBOM Data Format Name and Version, SBOM Author Signature, SBOM Tool Name and Version, SBOM Generation Context (before, during or after build), and Component Hash Algorithm.
• BSI lists component filename, source code URI, URI of the deployable form, and optional security.txt URL and source code hash. The extracted table does not show clear CISA counterparts for these.

What to do

The page's guidance on generation is to pull from source repositories, build artifacts, package manifests, lock files, container images and binary analysis. Output should be CycloneDX or SPDX, in JSON, XML, YAML or Tag-Value. SBOMs made at different lifecycle phases contain different information, so record the generation phase. To satisfy both specifications, populate the union of the fields above.

The advisory says an SBOM is a data layer, not a security solution. It must be tied to patching, mitigation and documented vulnerability-handling decisions. In the survey, respondents ranked industry consensus on integrating SBOM production and consumption into development practice first (23%). Integration into risk and compliance processes (19%) and guidance on how production and consumption methods should evolve (19%) followed.

Caveats

The advisory states it is not a legal interpretation of the Cyber Resilience Act and creates no obligations. Its recommendations may go beyond CRA requirements. The fetched text stops partway through the field table. The threat model (section 3), the CI/CD integration patterns and configuration requirements (section 4), and the security recommendations were not available, so this document does not cover them.