SBOM minimum elements: NTIA 2021 vs CISA 2026

A software bill of materials is only as useful as the data inside it. The "minimum elements" define the floor: the data fields, automation expectations and practices an SBOM needs so that a consumer can identify components, match them against vulnerability databases, and reason about risk.

The lineage is American. US Executive Order 14028 (May 2021) directed the government to define SBOM content for software sold to federal agencies, and the NTIA published the original minimum elements in July 2021: seven data fields plus automation support and practices. Those seven fields became the global de facto definition of a "complete" SBOM, quoted far beyond the US federal market.

On 29 July 2026, CISA and US and international partner agencies published the final 2026 Minimum Elements, which supersedes the NTIA baseline and applies to all software, explicitly including open-source software, AI software and software-as-a-service.

The core seven fields survive, some under new names, and the 2026 document raises the floor with fields the 2021 baseline left optional. The full field definitions and change summary are in the 2026 document (PDF), Appendix B.

Beyond data fields, the practice-level elements were renamed and sharpened:

The most consequential addition is the component hash. A name and version tell you what a component claims to be; a cryptographic hash lets you verify that the bytes you ship are the bytes the SBOM describes. That closes the gap between paper inventory and artifact, which matters for tamper detection and for matching binaries recovered in the field.

Machine-processable licenses promote license data from nice-to-have to minimum, using SPDX license identifiers so tools can evaluate obligations without a human parsing free text.

Tool name, tool version and generation context answer the question every SBOM consumer eventually asks: where did this SBOM come from? An SBOM generated from source at build time and one reconstructed from a shipped binary have different blind spots; the 2026 elements make that provenance explicit instead of leaving it to guesswork.

The EU Cyber Resilience Actlegally requires manufacturers to draw up an SBOM "in a commonly used and machine-readable format", but it does not define which fields the SBOM must contain. In practice, that content question gets answered by the reference baselines: the CISA minimum elements globally, and BSI TR-03183-2 in Germany, which similarly expects per-component licenses, hashes and dependency data.

An SBOM that meets the 2026 minimum elements is therefore strong evidence for the CRA technical documentation: it demonstrates a machine-readable inventory with verifiable components, exactly the artifact market surveillance authorities and customers will ask for. Read the full picture in our CRA & SBOM evidence guide, or test yourself with the CRA & SBOM quiz.

SBOM Total runs a dedicated CISA 2026 elements engine on every scan: component names, versions, producer names, unique identifiers (PURL or CPE), hashes, licenses and dependency relationships, evaluated across your whole CycloneDX, SPDX or Syft SBOM. The legacy NTIA 2021 check runs alongside it for continuity, and a BSI TR-03183 check covers the German baseline.

The result is a field-by-field verdict you can attach to your technical documentation, not a generic score.

What are the SBOM minimum elements?

The minimum elements are the baseline set of data fields, practices and processes an SBOM should contain to be usable: who produced each component, its name, version, identifiers, dependency relationships, and metadata about the SBOM itself. They were first defined by the US NTIA in July 2021 under Executive Order 14028, and were superseded by the CISA 2026 Minimum Elements published on 29 July 2026.

What is new in the CISA 2026 Minimum Elements?

The 2026 update adds new minimum data fields, notably the component hash (algorithm and value), machine-processable component license identifiers, the SBOM generation tool name and version, the SBOM generation context, and the SBOM data format and version. It also renames Supplier Name to Component Producer, Depth to Coverage, and Known Unknowns to Explicitly Identifying Unknown Information, and extends scope to open-source, AI software and SaaS.

Does the CISA 2026 document replace the NTIA minimum elements?

Yes. The 2026 Minimum Elements for a Software Bill of Materials, published by CISA with US and international partner agencies on 29 July 2026, supersedes the NTIA 2021 baseline that had been the reference for five years.

Are the CISA 2026 minimum elements legally binding?

The document itself is guidance, not a law. It becomes binding through other instruments: US federal procurement requirements building on Executive Order 14028, sector rules such as FDA premarket expectations for medical devices, and buyer contracts. In the EU, the Cyber Resilience Act legally requires an SBOM but does not define its fields, so auditors and customers commonly reach for the CISA elements as the de facto content baseline.

What is the difference between NTIA 2021 and CISA 2026?

NTIA 2021 defined seven baseline data fields (supplier, component name, version, unique identifiers, dependency relationship, SBOM author, timestamp) plus automation support and practices. CISA 2026 keeps that core, renames several elements, and raises the bar with cryptographic component hashes, machine-processable licenses, tool and generation context metadata, explicit format declaration, and a stronger focus on automation and coverage.

How do I check whether my SBOM meets the 2026 minimum elements?

Run it through a checker that validates the fields component by component. SBOM Total's free scan includes a dedicated CISA 2026 elements engine that checks component names, versions, producer names, unique identifiers (PURL or CPE), hashes, licenses and dependency relationships across your CycloneDX, SPDX or Syft SBOM, alongside the legacy NTIA 2021 check for continuity.