ENISA Technical Advisory for Software Bill of Materials

Modern software products contain hundreds or thousands of components, any of which may carry vulnerabilities. A Software Bill of Materials (SBOM) is a formal, machine-readable record of the components included in a product and of their supply chain relationships. It helps manufacturers and users to track newly emerged vulnerabilities and cybersecurity risks.

The European Union Agency for Cybersecurity (ENISA) has published a technical advisory with practical guidance on adopting SBOMs. It is intended for organisations, especially micro, small and medium-sized enterprises (SMEs), that are setting up their first SBOM capabilities. It is sector-agnostic and does not provide a framework for assessing organisational maturity.

What the advisory covers

• Architecture and data flows: the SBOM data model, the two predominant formats (SPDX and CycloneDX), and the types of SBOM according to the lifecycle phase in which they are generated.
• Lifecycle: the steps from generation, validation, cryptographic signing and storage to consumption and maintenance, how to integrate them into a CI/CD pipeline, and an indicative list of open-source tools.
• Threats and risks: an SBOM-focused threat model based on STRIDE, and general risks such as incomplete, outdated or inaccurate SBOMs, with indicative mitigation measures.
• Best practices: a minimum viable approach starting with build-time integration, common configuration requirements, and security controls such as access control, multi-factor authentication, audit logging and backups.

Context

The advisory considers requirements of the Cyber Resilience Act (Regulation (EU) 2024/2847) but describes best practices that may go beyond them. It is guidance only: its recommendations are non-mandatory and it should not be read as a legal interpretation of the Act. It draws on ENISA’s SBOM Adoption State of Play 2026 survey, which found that almost 73% of responding organisations use CycloneDX or SPDX.

Who can use it

ICT professionals in software development, security and operations teams can use the advisory to understand the concepts, tools and processes involved in producing and using SBOMs. It is published free of charge in English.

Source: ENISA, ENISA Technical Advisory for Software Bill of Materials, October 2026.

Topology of competences

Technical competences in software supply chain security: generating, validating, signing, storing and using SBOMs.

Methodology

Self-paced written technical guidance with a lifecycle model, threat model, best practices and an overview of open-source tools.