STP
SBOM Observer/

Concepts

Start here for standards, terminology, and encoding rules

Anchor yourself on the shared concepts before diving into detailed requirements.

Standards and Frameworks

Accepted specs (CycloneDX, SPDX, CSAF) and related quality frameworks.

Artifact Fundamentals

Requirement levels, terminology, and roles used across the framework.

Formats and encoding

JSON-only rule and format alignment across SBOM, VEX, and VDR.

Edit on GitHub