Home SecurityApplication Security SBOM formats SPDX and CycloneDX compared

SBOM formats SPDX and CycloneDX compared

Source Link

Software bills of materials (SBOMs) are becoming a critical component of vulnerability management. Many organizations, however, are still wrestling with understanding fundamental topics in the SBOM discussion, such as the differences among the SBOM formats.

What are SBOM formats?

SBOM formats are standards for defining a unified structure for generating SBOMs and sharing them with end users or customers. They describe the composition of software in a common format that other tools can understand.

The leading SBOM formats are Software Package Data Exchange (SPDX), Software Identification (SWID) Tagging, and CycloneDX. Only SPDX and CycloneDX are being adopted for security use cases. SWID is primarily focused on licensing and is therefore out of scope for this discussion. As the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and others have stated, we will have multiple SBOM formats for some time.


SPDX, a Linux Foundation project, was formed with the intent of creating a common data exchange format for information related to software packages for sharing and collection. SPDX supports the largest collection of file formats among the leading SBOM formats. These include RDFa, .xlsx, .spdx, .xml, .json, and .yaml. SPDX also aims to be a dynamic specification by being able to describe a set of software packages, files, or snippets.

SPDX is the only SBOM format that has achieved International Organization for Standardization (ISO) certification status, meaning it has met all the requirements for standardization and quality assurance as defined by ISO. This achievement, announced in September 2021 highlighted SPDX adoption by major corporations such as Intel, Microsoft, Siemens, and Sony that participate in the SPDX community. 

The SPDX specification as of the time of this writing is on version 2.2.2. To be considered a valid SPDX document, specific fields and sections must be present, which are defined in the SPDX specification. SPDX documents can be composed of fields and data such as document creation information, package information, file information, snippet information, licensing information, relationships, and annotations.

Copyright © 2022 IDG Communications, Inc.

Related Articles

Leave a Comment