CISA’s 2026 minimum elements apply to SaaS and AI software. Ask for the fields, the format, and the date. A slide is not a bill of materials.
Edited by Emilio Santos. October 1, 2026. Updated October 24, 2026.
The person who signs a software renewal and the person who has to answer a customer security review.
CISA’s July 29, 2026 minimum elements apply to all software, including open source, AI software, and SaaS. They update the 2021 NTIA baseline. Use them as a procurement list, not as a claim that every vendor is legally required to send you one tomorrow.
CISA’s release names four additions on top of the older baseline: component hash algorithm, component license, the name of the tool that generated the SBOM, and the context in which it was generated. Ask for those by name. Also ask for the component names and versions the document is built to carry. If a field is missing, the reply is incomplete against the 2026 list, even if the PDF looks thick.
| Reply | Treat it as |
|---|---|
| “We are SOC 2” | A different document |
| A logo slide of “trusted components” | Not an SBOM |
| A list with no license and no hash algorithm | Short of the 2026 elements |
| “Legal will not share our ingredients” | A commercial position you can price |
An SBOM is a list of the components inside a piece of software. When a serious vulnerability is announced in a common library, the companies that can answer “do we use this, and where?” in an hour are the ones with SBOMs from their vendors. The rest send emails and wait. The NTIA’s 2021 minimum elements set the original baseline: supplier name, component name, version, other unique identifiers, dependency relationships, the author of the SBOM data, and a timestamp. CISA’s 2026 update builds on that list with the four additions above.
The SBOM is also a signal. CISA’s Secure by Demand guide, published with the FBI in August 2024, lists the SBOM among the artifacts a customer can collect to judge whether a vendor builds security into its products. A vendor that can produce one quickly usually has its build process under control.
Illustrative case. Your company renews a document management product. The order form now says: “Supplier will provide a machine-readable SBOM in CycloneDX or SPDX format meeting CISA’s 2026 minimum elements within 30 days of signature, an updated SBOM with each major release, and an updated SBOM within 10 business days of remediating a critical vulnerability in a third-party component.” The vendor agrees to the first two and pushes back on the third. You settle on 15 business days. That is a real improvement over no clause at all, and it is in the contract rather than in a sales email.
The SBOM request pack builds this request, and the software renewal scorecard counts a missing SBOM against the renewal.
An SBOM shows what is inside, not whether each component is exploitable in that product. Pair it with the vendor’s vulnerability disclosure policy and, where available, statements on whether a given vulnerability affects the product. It also does not replace patching. It tells you where to look faster.
If the product includes a model or agent, add the questions in Extra SBOM questions for AI products. The July 2026 document is guidance on minimum elements. Your leverage is the contract. If the order does not ask for the file, you will not get the file.
No. It is an ingredient list. You still need a way to compare those ingredients to the vulnerabilities you care about.
Ask for this general SBOM and for the May 12, 2026 AI supplement. They are not substitutes.