The software half
CycloneDX ingest, components deduplicated by package URL, releases, deployments and licence policy.
Bill of materials
What a bill of materials is, and why one register works better than two
BOM, SBOM and HBOM all describe what something is made of. BOM is the general term, and SBOM and HBOM apply it to software and hardware. A list is useful when it is linked to the systems you actually run.
The three terms, plainly
The vocabulary has grown faster than the practice, and vendors use the words loosely. Here is what each term means and what it is for.
| Term | Lists | Answers |
|---|---|---|
| BOM bill of materials | The parts of anything. The general term, borrowed from manufacturing. | What is this made of? |
| SBOM software bill of materials | Components inside one software release: library, version, supplier, licence, and often a package URL that identifies it exactly. | What is inside what we ship, and who supplied it? |
| HBOM hardware bill of materials | The parts inside a hardware product, the companies that made them and where, as a vendor supplies them to a buyer (CISA HBOM Framework, 2023). | What is this device made of, and who made it where? |
| Asset register | The devices an organisation owns: serials, who holds each one, where it is and what state it is in. | What do we own, where is it, and who is responsible? |
| VEX vulnerability exploitability exchange | A position on a specific vulnerability in a specific product: affected, not affected, fixed, or under investigation, with the reasoning. | This CVE appears in our SBOM. Does it actually affect us? |
Why this became everybody's problem
Most modern software is assembled from parts. A typical service has a few thousand lines of your own code and several hundred dependencies you did not write, each with dependencies of its own. When one of them has a flaw, you need to find every system you run that contains it, quickly.
Log4Shell showed this to many organisations in December 2021. Some teams patched in hours and others took a fortnight. The fast teams already had a record of what was inside the software they shipped and where it was running.
Regulation has followed. US Executive Order 14028 made SBOMs a condition of federal software procurement. The EU Cyber Resilience Act obliges manufacturers of products with digital elements to maintain a bill of materials and to handle vulnerabilities for the supported life of the product. Private buyers now ask about SBOMs during due diligence whether or not a statute requires them.
From a list to an answer
Most tools stop once the document is generated. A bill of materials is useful in practice when four conditions hold, and real deployments often miss each of them.
- It is current. An SBOM generated once for a release you no longer run only describes the past. A CVE published today can affect a component you ingested months ago. You only find out when the release is scanned again against the current advisory feeds.
- It is attested. provenance keeps the exact bytes you publish, with their digest. A document regenerated from a database years later is not the artefact your build produced, and without the original bytes nobody can prove that a given SBOM is the one CI emitted.
- It is joined to deployment. Without the map from release to environment to machine, you cannot tell which findings are urgent.
- It records decisions as well as facts. Most findings turn out not to apply. provenance records the reasoning and the name of the person who made each call, so the triage does not have to be repeated every quarter and the auditor sees what was decided.
One register, because the question crosses the line
The market splits along an old boundary. IT asset management tools own hardware, and software composition analysis tools own dependencies. Both kinds of tool are mature. Neither can answer the question an incident poses, because that question needs both halves.
provenance keeps both halves in one register, linked by a deployment map. Each component belongs to releases. Each release is deployed into an environment and can be assigned to a named machine from the hardware register, with its custodian, site and lifecycle. A single lookup goes from a vulnerable library to the affected machines and the people responsible for them.
The hardware half
Devices with a full lifecycle, custodians, encryption evidence, point-in-time history and certified disposal.
Where they meet
Findings ranked by whether the affected release is deployed, with VEX positions a person approves.
Bill of materials: common questions
What is a bill of materials?
A bill of materials is a list of what a thing is made of, detailed enough for someone else to account for each part. The term comes from manufacturing, where a BOM lists the parts of a physical product. In software, an SBOM lists the components inside what you ship. In hardware, an HBOM lists the parts inside a device, who made them and where. Separately, an organisation keeps an asset register of the equipment it owns.
What is the difference between a BOM and an SBOM?
An SBOM, or software bill of materials, lists the libraries, versions, suppliers and licences inside one build of a piece of software. BOM is the general term, SBOM is its software form and HBOM its hardware form.
Is an SBOM legally required?
In more and more cases, yes. US Executive Order 14028 made SBOMs a condition of selling software to federal agencies. The EU Cyber Resilience Act obliges manufacturers of products with digital elements to keep one and to handle vulnerabilities across the product's lifetime. Many private buyers also ask for an SBOM during due diligence, whether or not a statute requires it.
What makes a bill of materials actually useful?
It needs to be current, complete and linked to what you run. A dependency list that does not show which release shipped each dependency, or where that release is running, cannot answer the only question that matters during an incident.
Why keep hardware and software in one register?
The questions that come up during an incident cover both. To act on a critical vulnerability in a library you need the releases that contain it, the ones that are deployed and the machines running them. When hardware and software live in separate systems, someone joins them by hand under time pressure, usually in a spreadsheet.
See it against your own estate
Free for personal use. For an organisation, tell us the size of the estate and what you need to evidence.