Software inventories distinguish components from vulnerability status

On July 29, 2026, CISA and partner agencies published revised software-bill-of-materials minimum elements, replacing the 2021 baseline. The guidance addresses information exchanged by software producers, buyers and operators. ^[1]

The guide calls for all components, including dependencies of dependencies, and accessible linked inventories. Missing fields should distinguish unknown information from information being withheld. Those requirements make a list’s scope and omissions important alongside its contents. ^[1]

NTIA’s July 12, 2021 report set a minimum of top-level dependencies with enough detail to seek deeper ones recursively. It acknowledged that supplier relationships could make greater depth unavailable and required authors to flag known unknowns. The baseline already distinguished incomplete data from confirmed absence. ^[2]

Vulnerability status is another layer. CISA’s April 2023 VEX guide describes machine-readable statements that identify a product as affected, not affected, fixed or under investigation for a particular vulnerability. A not-affected statement needs justification or an impact statement. An ingredient inventory and a product-specific vulnerability assessment answer different questions. ^[3]

About this item: Retrospective report. No first-hand reporting or independent testing is claimed. Corrections policy.