CISA’s July 29, 2026 minimum elements apply to all software, including open source, AI software, and SaaS. They update the 2021 NTIA baseline. Use them as a procurement list, not as a claim that every vendor is legally required to send you one tomorrow.
The fields
CISA’s release names four additions on top of the older baseline: component hash algorithm, component license, the name of the tool that generated the SBOM, and the context in which it was generated. Ask for those by name. Also ask for the component names and versions the document is built to carry. If a field is missing, the reply is incomplete against the 2026 list, even if the PDF looks thick.
The ask
- Machine-readable, not only a PDF. Say CycloneDX or SPDX if you already consume one of those. If you do not, still refuse a screenshot.
- The generation date, and how often a new file is produced. A file from the year the product launched is a souvenir.
- Whether hosted software is in scope. CISA says SaaS is in scope for the minimum elements. “We are a cloud app” is not an answer.
- Who will send an updated file after a critical component changes, and on what clock.
What fails
| Reply | Treat it as |
|---|---|
| “We are SOC 2” | A different document |
| A logo slide of “trusted components” | Not an SBOM |
| A list with no license and no hash algorithm | Short of the 2026 elements |
| “Legal will not share our ingredients” | A commercial position you can price |
FAQ
Does CISA require my vendor to send this?
The July 2026 document is guidance on minimum elements. Your leverage is the contract. If the order does not ask for the file, you will not get the file.
Is an SBOM a vulnerability report?
No. It is an ingredient list. You still need a way to compare those ingredients to the vulnerabilities you care about.
What about AI features?
Ask for this general SBOM and for the May 12, 2026 AI supplement. They are not substitutes.