US and Allies Update SBOM Guidance

Five years after the initial release, the refresh introduces new elements, removes others, and updates terminology. The post US and Allies Update SBOM Guidance appeared first on SecurityWeek .

Report facts: US agencies and 13 allied countries have released updated guidance on the minimum elements of a Software Bill of Materials (SBOM), refining data fields, adding items such as component hashes, licenses, tool metadata, and generation context, while explicitly noting that AI systems and SaaS may require additional SBOM elements[1]. The refresh preserves core NTIA 2021 principles but improves data quality, supports broader use cases, and updates terminology to reflect current software supply chain and transparency needs[1]. RealGround analysis: For AI-relevant organizations, this raises the bar for SBOM completeness and machine-readable transparency, directly impacting how AI software, models, and SaaS components must be inventoried and shared to manage supply chain risk. Practically, teams should align their SBOM generation and consumption workflows with the new minimum elements, extend SBOM coverage to AI-specific components, and integrate these inventories into vulnerability and license risk management—areas where structured AI supply chain advisory and readiness assessments are now critical.