Operational SBOM framework

Practical guidance for producing, sharing and using SBOM and VEX documents. Free and open source.

Excerpt from a CycloneDX SBOM: one component

{
  "type": "library",
  "name": "log4j-core",
  "version": "2.17.1",
  "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1",
  "hashes": [
    { "alg": "SHA-256", "content": "..." }
  ]
}

The framework defines which fields an SBOM should contain and what each field should say.

What to put in an SBOM, and what to do with it

SPDX and CycloneDX define the structure of an SBOM. They say little about which fields a consumer can rely on, how often to regenerate, how to deliver the file to customers, or what to do when a supplier sends one.

The framework covers that gap with content requirements, operational workflows and a maturity assessment.

Based on these standards and guidance

In the framework

Cyber Resilience Act

The CRA makes SBOMs and structured vulnerability handling part of the legal baseline for manufacturers selling in the EU.

What this means for SBOM and VEX

11 June 2026: Rules for notified conformity assessment bodies apply.
11 September 2026: Manufacturers report actively exploited vulnerabilities and severe incidents. In force now.
11 December 2027: All remaining obligations apply, including the essential cybersecurity requirements and the SBOM.