"SBOM Compliance in 5 Minutes: Generate Your First Software Bill of Materials"

Generating a Software Bill of Materials (SBOM) used to be complex and time-consuming. With modern tools, you can generate a compliance-ready SBOM in under a minute.

This guide covers everything: what an SBOM is, why you need one, how to generate it, and how to use it for compliance.

What is an SBOM?

An SBOM is a structured list of every software component in your application. Think of it as an "ingredient label" for your software.

Without an SBOM:

- "Our app uses Python, Flask, and... some other stuff"

- "We're not sure what dependencies we have"

- "We can't tell you if any of them have vulnerabilities"

With an SBOM:

- "Our app has 847 components across 12 ecosystems"

- "3 have known CVEs (2 critical, 1 medium)"

- "All licenses are permissive (Apache-2.0, MIT)"

- "Here's the complete list for your audit"

Why You Need an SBOM

SBOMs are becoming mandatory:

EU Cyber Resilience Act (CRA)

- Required for all software sold in the EU by 2027

- Must include all components, versions, and known vulnerabilities

- Fines up to €15M or 2.5% of global revenue

US Executive Order 14028

- Required for all software sold to the US federal government

- Must be machine-readable (CycloneDX or SPDX)

- Must include vulnerability information

FDA Cybersecurity Rule

- Medical device submissions must include SBOMs

- Must document all software components

- Must have a vulnerability management plan

PCI DSS 4.0

- Payment software must maintain component inventory

- Must track and remediate known vulnerabilities

How to Generate an SBOM

For a comparison of SBOM tools, see our Dependabot alternatives guide.

Method 1: CLI (Quickest)

pip install vulnledger
vulnledger scan ./my-project

This generates a CycloneDX SBOM and checks every dependency against OSV.dev for vulnerabilities.

Method 2: CI/CD Integration

Add to your GitHub Actions workflow:

name: SBOM Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Generate SBOM and scan
        run: |
          pip install vulnledger
          vulnledger scan . --json --output sbom-report.json
      - name: Security gate
        run: vulnledger scan . --ci  # fails if critical/high vulns

Method 3: Web Dashboard

Sign up at vulnledger.com, connect your GitHub repo, and get automatic SBOM generation on every scan.

Reading Your SBOM Report

Your SBOM report shows:

1. Total components — How many dependencies you have

2. Vulnerabilities — Known CVEs in your dependencies

3. Severity breakdown — Critical, high, medium, low

4. Fix versions — What to upgrade to

5. License information — Which licenses your dependencies use

From SBOM to Compliance

To turn your SBOM into a compliance document:

Step 1: Generate the SBOM

vulnledger scan . --json --output compliance-sbom.json

Step 2: Scan for Vulnerabilities

The scan automatically checks against OSV.dev. Review the results:

vulnledger scan . --json | jq '.summary'

Step 3: Document Your Process

Write down:

- How you generate SBOMs (automated via CI/CD)

- How you monitor for new CVEs (daily scans)

- How you handle vulnerability reports (process + SLA)

Step 4: Export as PDF

VulnLedger Pro+ generates compliance-ready PDF reports mapped to specific regulations.

Common SBOM Mistakes

1. Generating manually — Manual SBOMs get outdated instantly. Automate it.

2. Ignoring transitive dependencies — Your SBOM must include ALL dependencies, not just direct ones.

3. Not monitoring for new CVEs — An SBOM from January is useless if new CVEs are published in March.

4. Using the wrong format — Use CycloneDX or SPDX. Don't create your own format.

5. Treating SBOMs as one-time documents — SBOMs are living documents that need regular updates.

SBOM Formats: CycloneDX vs SPDX

The two main formats:

CycloneDX (by OWASP):

- Security-focused — built for vulnerability management

- Supports VEX (Vulnerability Exploitability eXchange)

- More concise JSON structure

- Growing adoption in DevSecOps

SPDX (by Linux Foundation):

- ISO standard (ISO/IEC 5962:2021)

- Best for license compliance

- Wider regulatory acceptance

- More verbose but comprehensive

Recommendation: Use CycloneDX if security is your primary concern. Use SPDX if license compliance or government contracts are your focus. VulnLedger supports both.

Real-World SBOM Example

Here's what a typical SBOM looks like for a Python web application:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "components": [
    {
      "name": "flask",
      "version": "3.0.0",
      "purl": "pkg:pypi/[email protected]",
      "type": "library",
      "licenses": [{"id": "BSD-3-Clause"}]
    },
    {
      "name": "requests",
      "version": "2.31.0",
      "purl": "pkg:pypi/[email protected]",
      "type": "library",
      "licenses": [{"id": "Apache-2.0"}]
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-1234",
      "severity": "high",
      "description": "Remote code execution in requests",
      "affects": [{"ref": "pkg:pypi/[email protected]"}]
    }
  ]
}

Best Practices

1. Automate SBOM generation — Add to CI/CD pipeline

2. Scan on every push — Catch vulnerabilities early

3. Store SBOMs with releases — Attach to GitHub releases, Docker images

4. Monitor continuously — Daily scans catch new CVEs

5. Document your process — Auditors want to see your workflow

6. Version your SBOMs — Each release gets a new SBOM version

7. Share with stakeholders — Customers, auditors, and partners may request SBOMs

8. Integrate with ticketing — When a vulnerability is found, auto-create a Jira/Linear issue

Getting Your First SBOM in 5 Minutes

If you've never generated an SBOM before, here's the fastest path:

1. Install the CLI: pip install vulnledger

2. Run a scan: vulnledger scan ./your-project

3. Review the output — you'll see every component and any known vulnerabilities

4. Set up automated scanning: add the command to your CI/CD pipeline

5. Schedule regular scans: configure daily or weekly scans in the VulnLedger dashboard

That's it. You now have a compliance-ready SBOM and continuous vulnerability monitoring.

Conclusion

SBOM compliance is no longer optional. The good news is that generating SBOMs is now easy and affordable. Start with one command, automate it in your CI/CD pipeline, and you'll be ready for any audit.

Get started:

pip install vulnledger
vulnledger scan ./my-project