MedTech Terms
    The authoritative reference
    All terms
    CybersecurityConnected & Cyber-Physical Devices

    CycloneDX

    A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    CycloneDX is an OWASP-flagship SBOM specification designed to support application security, supply-chain risk, and license compliance use cases. CycloneDX supports first-class representation of components, services, dependencies, vulnerabilities, exploitability (VEX), formulation (build provenance), and ML model bill-of-materials (ML-BOM). It is one of the two SBOM formats explicitly accepted by FDA.
    What the regulation says
    FDA's 2023 cybersecurity guidance accepts CycloneDX as a valid SBOM format. CycloneDX is the more common choice in pure-security pipelines because it natively models VEX in the same file as the SBOM, simplifying continuous vulnerability disclosure to operators. CISA's SBOM minimum elements are fully expressible in CycloneDX.

    What this means in practice

    CycloneDX has become the default for CI/CD-generated SBOMs in MedTech because community tooling (Syft, cdxgen, the CycloneDX CLI) and integrations with Anchore, Snyk, and Dependency-Track are mature. The single-file SBOM+VEX model meaningfully reduces the operational burden of post-market vulnerability response.
    Common pitfalls
    • •Producing CycloneDX without dependency relationships - that breaks transitive impact analysis.
    • •Using CycloneDX 1.4 when modern tooling expects 1.5/1.6.
    • •Skipping the BOM-Link / VEX block, forcing operators to maintain a separate exploitability feed.

    Frequently asked questions

    Yes. CycloneDX supports firmware, OS, library, framework, container, file, and operating-system component types - plus services and machine-learning models in newer versions.

    Cross-references

    Used by

    Related terms

    Shared paths + category
    Cybersecurity
    Software Bill of Materials(SBOM)

    A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.

    FDA Cybersecurity 101 · adjacent
    Cybersecurity
    Vulnerability Exploitability eXchange(VEX)

    A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.

    FDA Cybersecurity 101 · adjacent
    Cybersecurity
    Section 524B of the FD&C Act(524B)

    The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.

    FDA Cybersecurity 101
    Cybersecurity
    SPDX(SPDX)

    An open SBOM and license-data format published as ISO/IEC 5962:2021.

    Same category
    Cybersecurity
    Common Vulnerabilities and Exposures(CVE)

    A globally unique identifier for a publicly disclosed cybersecurity vulnerability.

    FDA Cybersecurity 101
    Cybersecurity
    Common Vulnerability Scoring System(CVSS)

    An industry-standard 0–10 score that quantifies the severity of a software vulnerability.

    FDA Cybersecurity 101

    Latest in MedTech

    Primary references

    3 sources
    Link health: 3 verified· last checked 2026-06-20
    OWASP·1ECMA·1FDA·1
    1. 1
      CycloneDX Specification
      Verified
      OWASPcyclonedx.org
    2. 2
      ECMA-424 CycloneDX Bill of Materials Standard
      Verified
      ECMAecma-international.org
    3. 3
      FDA Cybersecurity Guidance (Sept 2023)
      Verified
      FDAfda.gov

    Inline markers like [1] jump to the matching reference above.