CISA hardens SBOM rules: all dependencies, tooling names now mandatory
The shift from top-level-only to recursive coverage and mandatory tool disclosure turns SBOMs from aspirational checklist into an enforceable supply-chain control, even if CISA hasn't named the enforcement mechanism yet.
TL;DR
CISA published finalized updated SBOM minimum elements guidance on July 29, replacing the 2021 NTIA baseline. The new rules require coverage of all dependencies (not just top-level components) and add mandatory disclosure fields for component hash algorithm, component license, SBOM tool name, and SBOM generation context. Former CISA SBOM lead Allan Friedman told Inside Cybersecurity the expanded scope forces organizations to "be explicit about what they don't know" in their supply chain. The guidance, backed by the NSA, FBI, and 15 international partners, doesn't specify an implementation deadline or enforcement mechanism, leaving open whether existing SBOMs will need retroactive revision.
CISA's July 29 final guidance on SBOM minimum elements does something the 2021 NTIA original deliberately avoided: it tells software suppliers to map everything, not just the first layer. The new baseline requires "complete as possible" coverage, which in practice means all transitive dependencies, recursively. That's a material hardening, and it'll land on primes, subs, and managed service providers who've been shipping SBOMs that stopped at direct inclusions.
Allan Friedman, who led SBOM efforts at both NTIA and CISA before departing shortly before the August 2025 draft, walked through the shift with Inside Cybersecurity. "In 2021, as SBOMs were brand new, we talked about depth," Friedman said. "It was seen that you could not ask for a recursive analysis as a minimum. The minimum was top-level dependencies." The new document, he said, effectively says "we want to try to capture this as complete as possible, which essentially means all dependencies."
What the new fields actually demand
Four new minimum elements enter the baseline: Component Hash Algorithm, Component License, SBOM Tool Name, and SBOM Generation Context. The tool-name field is particularly interesting, Friedman flagged it as a lever for quality. SBOM generation isn't deterministic across tools, and varying tool quality means consumers need to know what produced the SBOM they're reading. "Identifying which tool was used is seen as a way of encouraging SBOM authors to use a quality tool that they can stand behind," Friedman said. Put less diplomatically: if your SBOM comes out of something you'd rather not name, that's now visible.
The guidance is co-signed by the NSA, FBI, and 15 international partners, a signal that the U.S. government is pushing for interoperability and that SBOMs are maturing past the experimental phase. ITI's Megan Petersen welcomed the update, noting that the guidance "recogni[zes] that critical technologies such as AI and software-as-a-service may require tailored approaches as implementation matures."
The gap nobody's filled yet
CISA hasn't set an implementation deadline. It hasn't described an enforcement mechanism. It hasn't said whether existing SBOMs already in agency hands need retroactive revision. For the practitioner who ships SBOMs to federal customers, those are the only three questions that matter Monday morning, and the guidance answers none of them. Friedman pointed toward next steps (reference implementations in SBOM data-format languages, neutral ground for the tooling and format communities to collaborate) and was candid that he doesn't know whether CISA can play that convening role today.
The 2021 NTIA document built the SBOM market. The 2026 CISA document is starting to regulate it. The gap between "here's what you must disclose" and "here's what happens if you don't" is the space where compliance directors now have to operate.
Published ·Deep Fathom