MedTech Terms
    The authoritative reference
    All terms

    CycloneDX

    A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    CycloneDX is an OWASP-flagship SBOM specification designed to support application security, supply-chain risk, and license compliance use cases. CycloneDX supports first-class representation of components, services, dependencies, vulnerabilities, exploitability (VEX), formulation (build provenance), and ML model bill-of-materials (ML-BOM). It is one of the two SBOM formats explicitly accepted by FDA.
    What the regulation says
    FDA's 2023 cybersecurity guidance accepts CycloneDX as a valid SBOM format. CycloneDX is the more common choice in pure-security pipelines because it natively models VEX in the same file as the SBOM, simplifying continuous vulnerability disclosure to operators. CISA's SBOM minimum elements are fully expressible in CycloneDX.

    What this means in practice

    CycloneDX has become the default for CI/CD-generated SBOMs in MedTech because community tooling (Syft, cdxgen, the CycloneDX CLI) and integrations with Anchore, Snyk, and Dependency-Track are mature. The single-file SBOM+VEX model meaningfully reduces the operational burden of post-market vulnerability response.
    Common pitfalls
    • •Producing CycloneDX without dependency relationships - that breaks transitive impact analysis.
    • •Using CycloneDX 1.4 when modern tooling expects 1.5/1.6.
    • •Skipping the BOM-Link / VEX block, forcing operators to maintain a separate exploitability feed.

    Frequently asked questions

    Yes. CycloneDX supports firmware, OS, library, framework, container, file, and operating-system component types - plus services and machine-learning models in newer versions.

    Cross-references

    Used by

    Things that build on this term.

    Primary references

    3 sources
    Link health: 2 verified 1 bot-blocked· last checked 2026-05-09
    OWASP·1ECMA·1FDA·1
    1. 1
      CycloneDX Specification
      Verified
      OWASPcyclonedx.org
    2. 2
      ECMA-424 CycloneDX Bill of Materials Standard
      Verified
      ECMAecma-international.org
    3. 3
      FDA Cybersecurity Guidance (Sept 2023)
      Bot-blocked
      FDAfda.gov

    Inline markers like [1] jump to the matching reference above.