Software Bill of Materials (SBOM) Under the CRA: Requirements and Best Practices

The CRA requires manufacturers to identify and document components contained in their products, including a Software Bill of Materials (SBOM). This seemingly simple requirement has profound implications for software development practices.

What the CRA Requires

Manufacturers must:

• Identify and document all components, including third-party and open-source libraries
• Maintain the SBOM throughout the product lifecycle
• Make the SBOM available to market surveillance authorities upon request
• Use the SBOM to facilitate vulnerability management

SBOM Formats

Two formats dominate:

• CycloneDX — OWASP standard, optimized for security use cases. JSON and XML formats
• SPDX — Linux Foundation standard, ISO/IEC 5962:2021. Strong on licensing data

Both are acceptable. CycloneDX is gaining traction in the security community; SPDX is preferred for license compliance. Many organizations generate both.

Integration into CI/CD

SBOM generation should be automated, not manual. Tools to consider:

• Syft (Anchore) — Generates SBOMs from container images and filesystems
• Trivy — Vulnerability scanning + SBOM generation
• cdxgen — CycloneDX generator for multiple languages
• GitHub/GitLab native — Both platforms offer dependency graph and SBOM export

Beyond Compliance

SBOMs aren't just a checkbox. When Log4Shell hit, organizations with SBOMs identified affected systems in hours instead of weeks. The SBOM becomes your supply chain radar — invest in it.