On July 30, 2026, CISA published updated minimum elements for a software bill of materials, replacing the 2021 NTIA baseline. The new elements add fields, apply to SBOMs for all software, and signal where requirements go next. Federal vendors and their suppliers should read this as a procurement change, not a technical footnote.
What changed
| Element | 2021 NTIA minimum | 2026 CISA minimum |
|---|---|---|
| Component identity | Supplier, name, version, unique identifiers | Same, plus component hash |
| Licensing | Not required | License information per component |
| Generation context | Author, timestamp | Plus the tool used to generate the SBOM and the generation context (build, source, or analysis) |
| Relationships | Dependency relationships | Same, with clearer expectations for transitive dependencies |
| Scope | Guidance for federal software | Applies to SBOMs for all software |
Source: Help Net Security coverage of CISA’s 2026 Minimum Elements for a Software Bill of Materials, July 30, 2026. The primary document is on cisa.gov.
What CISA signaled next
The 2026 guidance names AI systems, SaaS, SBOM signing and verification, and linkage to VEX and CSAF vulnerability documents as areas of future expectation. Vendors who treat the current elements as the ceiling will be back here in 2027.
How federal vendors should respond
- Inventory first. You cannot produce an accurate SBOM for software you cannot enumerate. Build the artifact and dependency inventory across repositories, containers, and build outputs, including transitive dependencies.
- Generate SBOMs in the pipeline, not by hand. Add SBOM generation to CI/CD in Bitbucket Pipelines, Azure DevOps, GitHub Actions, or GitLab so every build produces a current SBOM with hashes, licenses, and generation context.
- Validate coverage and accuracy. Sample SBOMs against the running software. Missing transitive dependencies are the most common gap.
- Route findings to owners. Vulnerabilities discovered against the SBOM go to a named team in Jira with an SLA. An SBOM without a remediation workflow is a report, not a control.
- Prepare for VEX. Document exploitability status for known vulnerabilities so customers can tell which findings actually apply.
- Keep the evidence current. Auditors and contracting officers ask for the SBOM for the version in production, not the one from last quarter.
What this means for healthcare and financial services
Healthcare vendors already face FDA cybersecurity expectations for medical devices and increasing SBOM asks from health systems. Financial institutions face third-party risk programs that now request SBOMs from software suppliers. The 2026 elements give both a common definition of “complete,” which means the asks will become more specific.
It is guidance that federal agencies and prime contractors reference in procurement. Contract language, not the guidance itself, makes it mandatory for a given vendor.
SPDX and CycloneDX remain the standard machine-readable formats. Both can carry the 2026 elements.
Yes. Both pipelines support SBOM generation with common tools, and findings can be routed to Jira for remediation.
Talk to a practitioner
VTPMO connects software inventory, pipeline controls, and remediation workflow so security evidence is a by-product of delivery.