SBOM (software bill of materials)

Firmware and apps are built from many open-source and third-party components. An SBOM lists them (names, versions, suppliers and dependencies) in a standard format such as SPDX or CycloneDX. When a new vulnerability is announced, an SBOM lets you answer "is this product affected?" in minutes rather than days, and it supports open-source license compliance.

SBOMs are increasingly expected or required: the EU Cyber Resilience Act makes one part of the technical documentation, US government guidance (NTIA's minimum elements and CISA resources) describes what they should contain, and the FDA expects them in cybersecurity documentation for connected medical devices.