FOSSA: CISA Releases the 2026 SBOM Minimum Elements

What it is

The finalized 2026 CISA Minimum Elements for an SBOM, replacing the 2021 NTIA baseline of seven fields. A draft went out for public comment in August 2025; this is the finalized result. The old 2021 fields were supplier name, component name, version, other unique identifiers, dependency relationship, author, and timestamp. The FOSSA post enumerates the full new field set and gives the implementation specifics the summary omits.

How it works

Fields are now split into SBOM Metadata (about the document) and Component Data (about the software). The seven metadata elements: SBOM Author Signature, Data Format Name, Data Format Version, Generation Context, Tool Name, Tool Version, and SBOM Version. New component elements: Component Hash Value, Component Hash Algorithm, and Component License.

Two decisions carry real engineering weight:

• SBOM Author Signature points to specific approved standards — NIST DSS, ISO/IEC 14888-4:2024, and ENISA's Agreed Cryptographic Mechanisms — and directs implementers to reuse existing software-signing infrastructure and key management rather than build new.
• SBOM Generation Context records the build lifecycle phase, which signals completeness to consumers:

flowchart TD
    A[When was SBOM generated?] --> B[Before build / source]
    A --> C[Build]
    A --> D[After build / binary analysis]
    B --> B1[Good for intent; may miss what ships]
    C --> C1[Highest fidelity]
    D --> D1[Use when you don't control build; limited by static analysis]

What to do

• License is now required and belongs in machine-processable form — ideally SPDX license identifiers. Flag proprietary conditions; use a URL fallback where no identifier exists.
• Component Producer (formerly "Supplier Name") resolves distributor-vs-originator ambiguity. If there's no clear producer, the SBOM author must explicitly mark the component as unknown provenance — silence is not acceptable.
• SBOM Author (formerly "Author of SBOM Data") is the producing entity, not the tool name, and is distinct from Component Producer.
• Prefer build-phase generation for highest fidelity where you control the build.

Caveats

The fetched text is truncated mid-sentence on Component Version and references eight major updates to carried-over elements but only fully shows SBOM Author, Component Producer, and (partially) Component Version. FOSSA explicitly recommends reading CISA's full publication for complete definitions. No effective date, compliance deadline, or enforcement mechanism (e.g., OMB attestation timing) appears in the excerpt.