## Summary An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of software components, their metadata, and their hierarchical relationships. Its core purpose is to identify components and their relationships unambiguously, which brings transparency to the software supply chain. That transparency lets stakeholders cut costs, security risks, license risks, and compliance risks across the software lifecycle. ## Key Points - An SBOM lists software components and dependencies, metadata about each, and how they nest hierarchically. - The primary purpose is to uniquely and unambiguously identify components and their relationships to one another. - SBOMs cover both open source and proprietary software and bring transparency to the supply chain. - Benefits span vulnerability management, asset management, procurement, license/compliance risk, and high-assurance work. - Interoperability across the supply chain needs standardized data formats and identification schemes. - SPDX, CycloneDX, and SWID are the three formats that identify software entities and carry the baseline metadata; tools exist to produce, consume, and transform them. ## Claim Atoms - **SBOM = machine-readable inventory of components and relationships** — the baseline definition; relationships are central, not just a flat parts list. - **An SBOM's primary purpose is unambiguous component identification** — everything else (security, licensing, procurement) builds on getting identity right. - **Three baseline formats: SPDX, CycloneDX, SWID** — interoperability depends on standardized formats and identification schemes, not ad hoc lists. ## Links - [[Perm · WordPress security is now a supply-chain + dependency risk, not just plugin reviews]] — an SBOM makes the dependency inventory visible enough to support the broader supply-chain threat model. - [[Software Bill of Materials (SBOM) - Enhancing Transparency and Supply Chain Security]] — Microsoft's generator is a concrete implementation of the machine-readable inventory and relationship model defined here. - [[3. Resources/MOCs/Open Source Governance MOC]] — connects standardized component identity and relationship data to supply-chain governance, procurement, and compliance. - [[3. Resources/Literature Notes/What's in Your AI — The Case for AI Bills of Materials (Alan Friedman, RSAC)]] — because extends: the AI-component successor to this baseline, arguing an AI BOM must include or be paired with a full SBOM rather than replace it.