Policy

The software ingredients list now covers the suite

CISA’s July 29 revision of the SBOM minimum elements applies to SaaS and AI software, not only to code you compile. The new fields are the ones to ask for.

By Emilio Santos October 1, 2026 12 min read
A workshop bench
An ingredients list is a procurement document. Photo: Circuit & Capital

On July 29, 2026, the Cybersecurity and Infrastructure Security Agency, with the National Security Agency, the FBI, and international partners, published the 2026 Minimum Elements for a Software Bill of Materials. CISA says the revision updates and replaces the minimum elements the National Telecommunications and Information Administration published in 2021. The line that changes a renewal: the minimum elements apply to all software, including open source, AI software, and software-as-a-service.

An SBOM is the ingredients list. CISA’s own description is that it lets a buyer see components and make a risk decision. It is not a vulnerability scan, and it is not a promise that the vendor is safe. It is the document you can ask for before you sign.

What was added

CISA’s release names new minimum elements that were not in the 2021 baseline: component hash algorithm, component license, the name of the tool that produced the SBOM, and SBOM generation context. The agency also says some software types, including AI and SaaS, may need elements beyond that baseline. A separate May 12, 2026 guide, written with G7 partners, is the supplemental list for AI systems. CISA is explicit that the AI list is in addition to the general minimum elements, and that it is guidance, not a statute that by itself obliges every vendor.

That distinction matters in a negotiation. You can require the document in a contract even where no regulator has yet required your vendor to hand it over. If you do not write it into the order, “we follow CISA” is a sentence, not a file.

A SaaS bill of materials that arrives as a PDF of marketing claims is not an SBOM. The 2026 elements are fields, not a brochure.

What to ask before the quarter closes

For each product you will renew, ask for an SBOM that includes the new fields, in a machine-readable format, and ask how often it is regenerated. For anything the vendor calls AI, ask for the general SBOM and the AI supplement, and ask which components are the model, the data, and the application around them. If the vendor sells only a hosted service, do not accept “SaaS does not have an SBOM.” CISA’s July revision says the minimum elements apply to SaaS.

Keep the ask tied to a decision. You want the list so you can see a license you cannot accept, a component you already banned, or a generation date older than the last incident. A list nobody reads is a folder.

What each new field is for

CISA named four additions. A renewal that “includes an SBOM” can still omit every one of them. Ask for the field, then ask what decision it supports.

  • Component hash algorithm. A hash without the algorithm that produced it is a string you cannot recompute. Ask which algorithm, and ask for the hash, not a screenshot of a hash.
  • Component license. This is the field that catches the component your counsel already banned. A product description that says “open source” is not a license name.
  • SBOM tool name. You want to know what generated the file, because two tools can describe the same product differently, and a hand-built spreadsheet will not tell you that it was hand-built unless you ask.
  • Generation context. Ask what context the file claims, and when it was produced. A generation date older than the release you are about to install is a stale list. CISA does not, on the pages this briefing uses, give you a single required sentence for the field. Do not accept a vendor’s invention of one and call it the minimum element.

AI and SaaS may need more than that baseline. That is CISA’s line, not a hint that SaaS is exempt. The May 12 AI supplement, written with G7 partners, sits on top of the general elements. Ask for both when the product is a model, a dataset, and an application wrapped together and sold as one login.

Why the list showed up in the same season as the exploit catalog

Between September 25 and September 30, CISA’s account posted three additions to the Known Exploited Vulnerabilities catalog: WordPress Core, an Apple bug, and Cisco Catalyst SD-WAN Manager. The catalog, read the next morning, also showed Citrix rows from September 27 and a Fortinet FortiMail row added October 1. The posts are the alerts. The catalog rows are the spec. The write-up is CISA listed three bugs attackers are already using.

An ingredients list is how you answer the first question those alerts create, which is not “how does the bug work.” It is “do we run this.” WordPress core, a mail gateway, a remote-access appliance, and an SD-WAN manager do not always appear in the application inventory the security team keeps. They appear, when you are lucky, in a bill of materials, a hosting contract, or a network diagram somebody last updated at renewal. Ask for the SBOM before you need it to identify a component CISA has already said is being used against somebody. Guidance is still not a statute. The contract is what makes the file show up.

Sources

Operator pages: the SBOM request pack, then Ask a vendor for an SBOM and Extra questions for an AI bill of materials.

ES
Emilio Santos writes and edits every piece on Circuit & Capital.
circuit50capital@circuits.fit