CISA published the 2026 Minimum Elements for a Software Bill of Materials on July 29, retiring the NTIA baseline that has defined a minimum SBOM since July 2021. The NSA, the FBI and 15 international partner agencies co-sealed the document. Ten data fields are new.
The additions are mostly about provenance and verification. Component Hash Value and Component Hash Algorithm let a consumer confirm that the component named in the file is the component that shipped. SBOM Tool Name, SBOM Tool Version, SBOM Data Format Name, SBOM Data Format Version and SBOM Generation Context record how the document itself was produced. SBOM Author Signature, SBOM Version and Component License complete the ten.
Renaming did as much work as the additions. Supplier Name is now Component Producer, and Author of SBOM Data is now SBOM Author, both marked as major updates rather than cosmetic ones. Depth became Coverage. Known Unknowns became Explicitly Identifying Unknown Information, widened to cover what a generator could not determine. Access Control is gone as a standalone element, folded into Distribution and Delivery.
For a device manufacturer the hash fields are the consequential part. An SBOM without a hash is an assertion about what went into a build. With a hash and a named algorithm, a hospital, an integrator or a regulator can check that claim against the binary they actually received. Generation context does similar work. An SBOM derived from source at build time and one reconstructed from a shipped binary carry very different coverage, and the old minimum elements gave a reader no field to tell them apart.
Section 524B has required an SBOM in premarket submissions for cyber devices since October 2023, and FDA guidance asks for a machine readable SBOM aligned with the NTIA minimum elements. That reference now points at a superseded document. CISA attached no effective date and no transition period, and joint guidance binds nobody on its own, but the baseline every downstream expectation was written against has moved.
The draft drew more than 90 comments before this version landed. SPDX and CycloneDX are named as the two formats in wide use, with a caution against accepting new SBOMs generated in deprecated versions of either. Add the ten fields to the generation pipeline now, while the change is a tooling configuration, rather than regenerating an archive of submitted SBOMs the first time a customer contract or an FDA reviewer starts asking for hashes.