This is a free browser tool on circuits.fit.
Ask a vendor for an ingredients list, then mark what came back.
A software bill of materials is an ingredients list for software: which components a product contains, who supplies them, which versions are inside, and how they depend on each other. When a component turns up on CISA’s Known Exploited Vulnerabilities catalog, the buyer with an SBOM can answer “are we affected?” in minutes. The buyer without one sends a questionnaire and waits.
On July 29, 2026, CISA, the NSA, the FBI and international partners published the 2026 Minimum Elements for a Software Bill of Materials . It replaces the minimum elements the National Telecommunications and Information Administration published in 2021. CISA says the minimum elements apply to all software, and that some types, including AI and software as a service, may need additional elements. That matters for buyers: “we are SaaS, so an SBOM does not apply” is no longer the answer the guidance supports.
Not legal, tax, insurance, or procurement advice. Inputs stay in this browser. Nothing is uploaded.
Top comments (0)