SPDX
An open SBOM and license-data format published as ISO/IEC 5962:2021.
Definition
SPDX (Software Package Data Exchange) is an open specification, maintained by the Linux Foundation and standardized as ISO/IEC 5962:2021, for communicating software bill-of-materials information including components, licenses, copyrights, and security references. SPDX 3.0 (2024) extends the format with profiles for security, AI/ML, and dataset provenance. It is one of the two SBOM formats explicitly accepted by FDA (the other is CycloneDX).What this means in practice
SPDX is most common in build pipelines that already use it for license compliance (e.g., automotive, aerospace, large enterprise software). For MedTech teams choosing fresh, CycloneDX is often easier to pair with VEX, but SPDX is fully acceptable to FDA and a better fit when license attribution is also a deliverable.Examples
- A MedTech manufacturer uses an SPDX document to provide the FDA with a comprehensive software bill of materials, including details on all open-source and commercial components within their new medical device firmware.
- During a software supply chain audit, a hospital's IT department reviews the SPDX file accompanying a diagnostic imaging system to verify component licenses and identify any known security vulnerabilities.
- An engineering team integrates an SPDX generator into their continuous integration pipeline to automatically produce up-to-date SBOMs, streamlining both license compliance checks and security reviews for their embedded medical software.
- •Treating SPDX as solely a license-compliance artifact and omitting security-relevant metadata.
- •Producing SPDX 1.x or 2.x output when modern tooling expects SPDX 2.3 or 3.0.
- •Hand-editing SPDX files instead of generating them from the build - drift is inevitable.
Frequently asked questions
Cross-references
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsA lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.
A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.
More in Cybersecurity
· Same categoryAAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
3 sourcesEvery citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1SPDX SpecificationsTier 2 VerifiedLinux Foundationspdx.dev
- 2ISO/IEC 5962:2021 (SPDX)Tier 1 VerifiedISO/IECiso.org
- 3FDA Cybersecurity Guidance (Sept 2023)Tier 2 VerifiedFDAfda.gov
Inline markers like [1] jump to the matching reference above.