The US and allied governments refreshed the SBOM Minimum Elements guidance originally released in 2021 to address evolving software supply chain security needs. The update adds new elements such as Component Hash Algorithm, Component License, Author Signature, and others, while removing elements like Access Control and Software Identification (SWID) Tags. Terminology and data mapping have been improved to enhance clarity and usability. The guidance supports a broader range of use cases and reflects advances in SBOM tooling and practices. It is intended as a baseline for software producers, procurers, and operators to improve supply chain visibility and risk management. The update is a policy and standards document, not a software vulnerability or exploit.

This update improves the quality and scope of SBOM data, enabling organizations to better inventory software components and manage supply chain risks. It does not represent a direct security vulnerability or exploit but enhances the ability to identify and address vulnerabilities in software supply chains. There are no known exploits or active threats associated with this guidance update.

This is an update to guidance on SBOM elements rather than a vulnerability requiring patching. Organizations should review and adopt the updated SBOM minimum elements to improve software supply chain transparency and risk management. No direct remediation or patch is applicable. The update builds on existing practices and tools, and no immediate action beyond aligning with the new guidance is required.