--- title: "CycloneDX, Definition | MedTech Terms" description: "A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. Plain-English Cybersecurity definition for MedTech tea" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cyclonedx#term", "name": "CycloneDX", "description": "CycloneDX is an OWASP-flagship SBOM specification designed to support application security, supply-chain risk, and license compliance use cases. CycloneDX supports first-class representation of components, services, dependencies, vulnerabilities, exploitability (VEX), formulation (build provenance), and ML model bill-of-materials (ML-BOM). It is one of the two SBOM formats explicitly accepted by FDA.", "url": "https://medtechterms.com/terms/cyclonedx", "termCode": "cyclonedx", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/cyclonedx#article", "headline": "CycloneDX", "description": "A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.", "url": "https://medtechterms.com/terms/cyclonedx", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/cyclonedx" }, "about": { "@id": "https://medtechterms.com/terms/cyclonedx#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "CycloneDX, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "CycloneDX Specification", "url": "https://cyclonedx.org/specification/overview/", "publisher": { "@type": "Organization", "name": "OWASP" } }, { "@type": "CreativeWork", "name": "ECMA-424 CycloneDX Bill of Materials Standard", "url": "https://ecma-international.org/publications-and-standards/standards/ecma-424/", "publisher": { "@type": "Organization", "name": "ECMA" } }, { "@type": "CreativeWork", "name": "FDA Cybersecurity Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdx#term", "name": "SPDX", "alternateName": "SPDX", "url": "https://medtechterms.com/terms/spdx" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/vex#term", "name": "Vulnerability Exploitability eXchange", "alternateName": "VEX", "url": "https://medtechterms.com/terms/vex" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "CycloneDX", "item": "https://medtechterms.com/terms/cyclonedx" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/cyclonedx#faq", "mainEntity": [ { "@type": "Question", "name": "Does CycloneDX cover firmware?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. CycloneDX supports firmware, OS, library, framework, container, file, and operating-system component types - plus services and machine-learning models in newer versions." } }, { "@type": "Question", "name": "Which CycloneDX version should we emit?", "acceptedAnswer": { "@type": "Answer", "text": "1.5 (2023) is the current widely-supported version; 1.6 adds further security enhancements. Avoid 1.3 and earlier." } }, { "@type": "Question", "name": "Is CycloneDX a standard?", "acceptedAnswer": { "@type": "Answer", "text": "It is an OWASP standard and an ECMA International standard (ECMA-424). It is not yet an ISO standard the way SPDX is, but is widely adopted by industry and accepted by FDA." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. CycloneDX [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) # CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition CycloneDX is an OWASP-flagship [SBOM](/terms/sbom) specification designed to support application security, supply-chain risk, and license compliance use cases. CycloneDX supports first-class representation of components, services, dependencies, vulnerabilities, exploitability ( [VEX](/terms/vex)), formulation (build provenance), and ML model bill-of-materials (ML- [BOM](/terms/bom)). It is one of the two SBOM formats explicitly accepted by FDA. What the regulation says FDA's 2023 cybersecurity guidance accepts CycloneDX as a valid [SBOM](/terms/sbom) format. CycloneDX is the more common choice in pure-security pipelines because it natively models [VEX](/terms/vex) in the same file as the SBOM, simplifying continuous vulnerability disclosure to operators. CISA's SBOM minimum elements are fully expressible in CycloneDX. ## What this means in practice CycloneDX has become the default for CI/CD-generated SBOMs in MedTech because community tooling (Syft, cdxgen, the CycloneDX CLI) and integrations with Anchore, Snyk, and Dependency-Track are mature. The single-file [SBOM](/terms/sbom)+ [VEX](/terms/vex) model meaningfully reduces the operational burden of post-market vulnerability response. Common pitfalls - • Producing CycloneDX without dependency relationships - that breaks transitive impact analysis. - • Using CycloneDX 1.4 when modern tooling expects 1.5/1.6. - • Skipping the BOM-Link / VEX block, forcing operators to maintain a separate exploitability feed. ## Frequently asked questions Does CycloneDX cover firmware? Yes. CycloneDX supports firmware, OS, library, framework, container, file, and operating-system component types - plus services and machine-learning models in newer versions. Which CycloneDX version should we emit? Is CycloneDX a standard? ## Cross-references ### Used by Things that build on this term. - [ Software Bill of Materials(SBOM) ](/terms/sbom) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. ](/terms/sbom)[ Cybersecurity Vulnerability Exploitability eXchange(VEX) A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. ](/terms/vex)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity SPDX(SPDX) An open SBOM and license-data format published as ISO/IEC 5962:2021. ](/terms/spdx) ### FDA Cybersecurity 101 · From this learning path [ Cybersecurity Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. ](/terms/cve?from=fda-cybersecurity-101)[ Cybersecurity Common Vulnerability Scoring System(CVSS) An industry-standard 0–10 score that quantifies the severity of a software vulnerability. ](/terms/cvss?from=fda-cybersecurity-101)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity?from=fda-cybersecurity-101)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf?from=fda-cybersecurity-101) Cited by Where this term appears across MedTech Terms. Learning paths (1) - [FDA Cybersecurity 101](/paths/fda-cybersecurity-101)Lesson 7 of 11 Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 OWASP· 1 ECMA· 1 FDA· 1 1. [1 CycloneDX Specification Verified OWASP · cyclonedx.org ](https://cyclonedx.org/specification/overview/) 2. [2 ECMA-424 CycloneDX Bill of Materials Standard Verified ECMA · ecma-international.org ](https://ecma-international.org/publications-and-standards/standards/ecma-424/) 3. [3 FDA Cybersecurity Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=cyclonedx) Learn in 60 seconds Card Lesson Quiz A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. - · CycloneDX has become the default for CI/CD-generated SBOMs in MedTech because community tooling (Syft, cdxgen, the CycloneDX CLI) and integrations with Anchore, Snyk, and Dependency-Track are mature. - · The single-file SBOM+VEX model meaningfully reduces the operational burden of post-market vulnerability response. - · CycloneDX supports first-class representation of components, services, dependencies, vulnerabilities, exploitability (VEX), formulation (build provenance), and ML model bill-of-materials (ML-BOM). Remember this Watch out: Producing CycloneDX without dependency relationships - that breaks transitive impact analysis. Related terms - [Software Bill of Materials(SBOM) ](/terms/sbom) - [SPDX(SPDX) ](/terms/spdx) - [Vulnerability Exploitability eXchange(VEX) ](/terms/vex) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Supply-chain Levels for Software Artifacts(SLSA) ](/terms/slsa) - [FedRAMP(FedRAMP) ](/terms/fedramp) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [AAMI TIR97(TIR97) ](/terms/aami-tir97) - [IEC 80001-1 ](/terms/iec-80001) - [OWASP IoT and Embedded Application Security ](/terms/owasp-iot) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)