--- title: "SBOM, Software Bill of Materials | MedTech Terms" description: "A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": [ "SBOM", "software bill of materials" ], "description": "A Software Bill of Materials (SBOM) is a formal, machine-readable record of every software component - including third-party, open-source, and commercial dependencies - that ships in a medical device, together with the supply-chain relationships between those components. An SBOM typically lists each component's name, version, supplier, license, and a cryptographic identifier so vulnerabilities disclosed against any component can be matched back to the devices that contain it. The two industry-standard formats are CycloneDX (OWASP) and SPDX (Linux Foundation, ISO/IEC 5962:2021).", "url": "https://medtechterms.com/terms/sbom", "termCode": "sbom", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/sbom#article", "headline": "SBOM, Software Bill of Materials", "description": "A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.", "url": "https://medtechterms.com/terms/sbom", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/sbom" }, "about": { "@id": "https://medtechterms.com/terms/sbom#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Software Bill of Materials, SBOM, software bill of materials, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "Section 524B of the FD&C Act", "url": "https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "CISA SBOM Resources & Minimum Elements", "url": "https://www.cisa.gov/sbom", "publisher": { "@type": "Organization", "name": "CISA" } }, { "@type": "CreativeWork", "name": "CycloneDX Specification", "url": "https://cyclonedx.org/specification/overview/", "publisher": { "@type": "Organization", "name": "OWASP" } }, { "@type": "CreativeWork", "name": "SPDX Specification (ISO/IEC 5962:2021)", "url": "https://spdx.dev/specifications/", "publisher": { "@type": "Organization", "name": "Linux Foundation" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdx#term", "name": "SPDX", "alternateName": "SPDX", "url": "https://medtechterms.com/terms/spdx" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cyclonedx#term", "name": "CycloneDX", "url": "https://medtechterms.com/terms/cyclonedx" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/vex#term", "name": "Vulnerability Exploitability eXchange", "alternateName": "VEX", "url": "https://medtechterms.com/terms/vex" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cve#term", "name": "Common Vulnerabilities and Exposures", "alternateName": "CVE", "url": "https://medtechterms.com/terms/cve" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Software Bill of Materials", "item": "https://medtechterms.com/terms/sbom" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/sbom#faq", "mainEntity": [ { "@type": "Question", "name": "Is an SBOM required for every FDA submission?", "acceptedAnswer": { "@type": "Answer", "text": "An SBOM is required for any submission that meets the statutory definition of a 'cyber device' under section 524B of the FD&C Act - broadly, devices that include software validated, installed, or authorized by the sponsor and have the ability to connect to the internet. That captures most modern Class II and Class III software-containing devices." } }, { "@type": "Question", "name": "CycloneDX or SPDX - which format should we use?", "acceptedAnswer": { "@type": "Answer", "text": "FDA accepts either. CycloneDX is more common in security-tooling pipelines and pairs naturally with VEX. SPDX is broader (also used for license compliance) and is an ISO/IEC standard. Pick whichever your build toolchain produces natively; converters exist between the two." } }, { "@type": "Question", "name": "Do hospitals get to see our SBOM?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Hospitals increasingly request the SBOM as part of procurement and post-market vulnerability response. The Healthcare Sector Coordinating Council (HSCC) Joint Security Plan and the AHA's medical-device security guidance both reference SBOM disclosure to operators." } }, { "@type": "Question", "name": "How often does the SBOM need to be updated?", "acceptedAnswer": { "@type": "Answer", "text": "The SBOM should be regenerated for every software change that ships to the field - patches, hot-fixes, model updates, the lot. The FDA guidance ties SBOM maintenance to the device's supported lifetime, not a calendar cadence." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Software Bill of Materials [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Software Lifecycle](/ecosystems/software-lifecycle)SBOM # Software Bill of Materials A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition A Software [Bill of Materials](/terms/bom) (SBOM) is a formal, machine-readable record of every software component - including third-party, open-source, and commercial dependencies - that ships in a medical device, together with the supply-chain relationships between those components. An SBOM typically lists each component's name, version, supplier, license, and a cryptographic identifier so vulnerabilities disclosed against any component can be matched back to the devices that contain it. The two industry-standard formats are [CycloneDX](/terms/cyclonedx) (OWASP) and [SPDX](/terms/spdx) (Linux Foundation, ISO/IEC 5962:2021). What the regulation says [Section 524B of the FD&C Act](/terms/section-524b), added by the Consolidated Appropriations Act of 2023, makes a complete SBOM a statutory requirement for cyber device premarket submissions. FDA's September 2023 guidance "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions" specifies that the SBOM must be machine-readable ( [CycloneDX](/terms/cyclonedx) or [SPDX](/terms/spdx)), include commercial, open-source, and off-the-shelf components, identify support level and end-of-support dates for each, and describe the process for monitoring and addressing vulnerabilities throughout the device's supported lifetime. CISA's SBOM minimum elements (NTIA 2021) define the floor: supplier name, component name, version, unique identifier, dependency relationship, author, and timestamp. ## What this means in practice An SBOM is not a one-time artifact - it must be regenerated and reviewed whenever software changes and made available to operators (typically hospital security teams) who use it to assess the device's exposure to newly disclosed CVEs. In practice, MedTech teams generate SBOMs from their CI/CD pipeline (Syft, [CycloneDX](/terms/cyclonedx)\-Maven, [SPDX](/terms/spdx) tooling), pair each SBOM with a [VEX](/terms/vex) document that explains which CVEs are not exploitable in their product, and store both with the [Design History File](/terms/design-history-file). Hospital procurement increasingly requires an [MDS2](/terms/mds2) form plus a current SBOM before purchase. ## Use cases 2 scenarios 1 ### Premarket cybersecurity submission for a connected infusion pump Product security engineer Engineering produces a [CycloneDX](/terms/cyclonedx) SBOM from the CI pipeline covering firmware, OS, and third-party libraries. They map each component to known CVEs, attach a [VEX](/terms/vex) document marking unaffected vulnerabilities, and include the SBOM in the [524B](/terms/section-524b) section of the 510(k). Outcome FDA accepts the cybersecurity package on first review; hospital procurement teams reuse the SBOM for their own risk assessments. 2 ### Hospital responding to a new OpenSSL CVE Healthcare delivery org (HDO) A hospital biomed team queries vendor SBOMs for OpenSSL versions affected by a newly published critical [CVE](/terms/cve). They cross-reference vendor [VEX](/terms/vex) statements to filter out devices where the vulnerable code path isn't reachable. Outcome Patching is prioritized to ~12 truly affected device families instead of all 400+ network-connected devices. Common pitfalls - • Generating an SBOM only at submission rather than continuously through the build pipeline. - • Omitting transitive dependencies, firmware blobs, or commercial third-party components such as RTOS or DRM libraries. - • Shipping an SBOM without a VEX (Vulnerability Exploitability eXchange) document - leaving operators to triage every CVE themselves. - • Treating SBOM generation as a regulatory checkbox rather than feeding it into a real vulnerability-monitoring workflow. ## Frequently asked questions Is an SBOM required for every FDA submission? An SBOM is required for any submission that meets the statutory definition of a 'cyber device' under [section 524B of the FD&C Act](/terms/section-524b) - broadly, devices that include software validated, installed, or authorized by the sponsor and have the ability to connect to the internet. That captures most modern Class II and Class III software-containing devices. CycloneDX or SPDX - which format should we use? Do hospitals get to see our SBOM? How often does the SBOM need to be updated? ## Cross-references ### Uses Concepts or artefacts this term builds on. - [ SPDX(SPDX) ](/terms/spdx) - [ CycloneDX ](/terms/cyclonedx) ### Used by Things that build on this term. - [ Section 524B of the FD&C Act(524B) ](/terms/section-524b) ### See also Closely related context worth reading. - [ Vulnerability Exploitability eXchange(VEX) ](/terms/vex) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. ](/terms/cyclonedx)[ Cybersecurity Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. ](/terms/cve)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity) ### FDA Cybersecurity 101 · From this learning path [ Cybersecurity Vulnerability Exploitability eXchange(VEX) A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. ](/terms/vex?from=fda-cybersecurity-101)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. Adjacent lesson ](/terms/spdf?from=fda-cybersecurity-101)[ Cybersecurity Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. Adjacent lesson ](/terms/threat-modeling?from=fda-cybersecurity-101)[ Cybersecurity STRIDE Threat Model(STRIDE) A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Adjacent lesson ](/terms/stride?from=fda-cybersecurity-101) ### Software Team Onboarding · From this learning path [ Software & AI Clinical Decision Support(CDS) Software providing healthcare professionals with knowledge and patient-specific information. ](/terms/cds?from=software-team-onboarding)[ Standards IEC 62304 Lifecycle requirements for medical device software. ](/terms/iec-62304?from=software-team-onboarding)[ Software & AI Predetermined Change Control Plan(PCCP) FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices. ](/terms/ai-ml-pccp?from=software-team-onboarding)[ Software & AI Software as a Medical Device(SaMD) Software intended for medical purposes that performs without being part of a hardware device. ](/terms/samd?from=software-team-onboarding) Cited by Where this term appears across MedTech Terms. Learning paths (2) - [FDA Cybersecurity 101](/paths/fda-cybersecurity-101)Lesson 6 of 11 - [Software Team Onboarding](/paths/software-team-onboarding)Lesson 10 of 12 Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Software Lifecycle](/ecosystems/software-lifecycle) ## Primary references 5 sources Link health: 5 verified · last checked 2026-06-20 FDA· 2 CISA· 1 OWASP· 1 Linux Foundation· 1 1. [1 Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 2. [2 Section 524B of the FD&C Act Verified FDA · fda.gov ](https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity) 3. [3 CISA SBOM Resources & Minimum Elements Verified CISA · cisa.gov ](https://www.cisa.gov/sbom) 4. [4 CycloneDX Specification Verified OWASP · cyclonedx.org ](https://cyclonedx.org/specification/overview/) 5. [5 SPDX Specification (ISO/IEC 5962:2021) Verified Linux Foundation · spdx.dev ](https://spdx.dev/specifications/) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Need help generating an FDA-compliant SBOM? Blue Goat Cyber helps MedTech teams produce CycloneDX/SPDX SBOMs that pass premarket review and stay current through the device lifecycle. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym SBOM Sources 5 Use cases 2 Updated 5/5/2026 [Compare with another term](/compare?a=sbom) Learn in 60 seconds Card Lesson Quiz A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. - · Hospital procurement increasingly requires an MDS2 form plus a current SBOM before purchase. - · The two industry-standard formats are CycloneDX (OWASP) and SPDX (Linux Foundation, ISO/IEC 5962:2021). Remember this Watch out: Generating an SBOM only at submission rather than continuously through the build pipeline. Related terms - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [SPDX(SPDX) ](/terms/spdx) - [CycloneDX ](/terms/cyclonedx) - [Vulnerability Exploitability eXchange(VEX) ](/terms/vex) - [Common Vulnerabilities and Exposures(CVE) ](/terms/cve) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Bill of Materials(BOM) ](/terms/bom) - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) - [Common Vulnerability Scoring System(CVSS) ](/terms/cvss) - [Over-the-Air Updates(OTA) ](/terms/ota-updates) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [Side-Channel Attack ](/terms/side-channel) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)