SBOM minimum elements

Guide · Cybersecurity

SBOM minimum elements for medical devices

CISA's 2026 minimum elements replace the 2021 NTIA baseline, and FDA asks device makers for more than either. Here is what changed, field by field, and what a premarket submission needs.

data fields in CISA 2026

new since 2021

524B(b)(3)

SBOM required for cyber devices

Oct 2026

last reviewed

See the field changes What FDA adds

How we got here

May 2021

Executive Order 14028

Directs NTIA to publish SBOM minimum elements.

Jul 2021

NTIA minimum elements

Seven data fields plus automation support and practices.

Dec 2022

FDORA adds section 524B

SBOM becomes a statutory requirement for cyber devices, from March 2023.

Apr 2023

IMDRF N73

SBOM principles and practices for medical device cybersecurity.

2023 to 2026

FDA premarket guidance

Final in Sep 2023, updated Jun 2025, revised Feb 2026 for the QMSR.

Jul 2026

CISA 2026 minimum elements

Replaces NTIA 2021. Co-authored with NSA, FBI and 15 international agencies.

Data fields, NTIA 2021 vs CISA 2026

CISA kept all seven 2021 fields, renamed four of them, and added ten. An SBOM built to the 2026 list still covers the NTIA baseline that FDA's guidance points to.

NewRenamedUpdated

CISA 2026 field	NTIA 2021	Change	Why it matters for a device team
SBOM metadata
SBOM Author	Author of SBOM Data	Renamed	Names the entity that produced the SBOM, not the tool. Usually you, the manufacturer.
SBOM Timestamp	Timestamp	Updated	Date and time of the most recent update, so reviewers can match it to a release.
SBOM Version	None	New	Tracks revisions of the SBOM itself across software releases.
SBOM Author Signature	None	New	A digital signature, so recipients can trust the SBOM came from you unaltered.
SBOM Data Format Name and Version	None	2 new	Declares the format, such as SPDX or CycloneDX, and its version.
SBOM Tool Name and Version	None	2 new	Records which tool generated or amended the SBOM. Useful when tools disagree.
SBOM Generation Context	None	New	States the lifecycle phase, such as source, build or shipped binary. A build-time SBOM is closer to what ships.
Component data
Component Producer	Supplier Name	Renamed	The entity that creates the component, not a reseller or distributor.
Component Name	Component Name	Updated	The producer's name for the component. Alternate names are allowed.
Component Version	Version of the Component	Renamed	Mark it unknown when it is unknown, rather than leaving it blank.
Component Identifiers	Other Unique Identifiers	Renamed	At least one machine-processable identifier, such as a PURL or CPE, for vulnerability lookups.
Component Dependency Relationship	Dependency Relationship	Updated	Records which components another component needs in order to operate.
Component Hash Value and Algorithm	None	2 new	A cryptographic hash of the component artifact, so anyone can verify the binary you declared.
Component License	None	New	License identifiers, ideally machine-readable. Feeds your open-source and supplier controls.

What changed in the practices

Coverage

was Depth

All components, including transitive dependencies. In CISA's words, "There is no minimum depth."

Explicitly identifying unknown information

was Known Unknowns

Separate what is truly unknown from what is deliberately withheld.

Machine-processable data

was Automation Support

SPDX and CycloneDX. SWID tags are no longer listed.

Accommodation of updates

was Accommodation of Mistakes

Assumes the data is accurate and focuses on keeping it current.

Distribution and delivery

absorbs Access Control

The separate access control element was removed.

Frequency

unchanged intent

A new SBOM with each build or release.

What FDA asks for beyond the fields

The minimum elements describe an SBOM. FDA's premarket guidance also asks what you know about each component and its risks.

Required for cyber devices

Section 524B(b)(3) of the FD&C Act requires an SBOM covering commercial, open-source and off-the-shelf components.

Machine-readable

Consistent with the NTIA minimum elements, in an industry-accepted format, and maintained under configuration management.

Support level and end-of-support

For each component, the level of support from its manufacturer and its end-of-support date.

Known vulnerabilities, assessed

All known vulnerabilities, including those in CISA's KEV catalog, how you found them, and a safety and security risk assessment of each.

If some SBOM information cannot be provided, FDA asks for a justification in the submission.

In the EU, devices sit outside the Cyber Resilience Act

Article 2(2) of the CRA (Regulation (EU) 2024/2847) excludes products covered by the MDR and IVDR. Device makers follow the MDR and IVDR software and IT security requirements and the MDCG 2019-16 cybersecurity guidance instead.

Neither names an SBOM outright, but MDCG 2019-16 expects ongoing vulnerability monitoring, and IEC 81001-5-1 describes an SBOM. In practice an SBOM is how you show both in the technical file.

CRA

Not applicable to MDR and IVDR devices

MDR and IVDR Annex I

State-of-the-art software and IT security

MDCG 2019-16 rev. 1

Vulnerability monitoring across the lifecycle

IEC 81001-5-1

Secure lifecycle, and describes the SBOM

Submission checklist

Generate the SBOM from the build of the release you submit, and record the generation context.

Use SPDX or CycloneDX, machine-readable, and version and sign each SBOM.

For every component, record the producer, name, version, a PURL or CPE, hash and license.

Add each component's support level and end-of-support date.

List known vulnerabilities, check them against CISA KEV, and assess each one.

Regenerate the SBOM with every release and keep it under configuration management.

From the library

Open the library →

PDF

2026 Minimum Elements for a Software Bill of Materials (CISA, Jul 2026)

CISA's replacement for the NTIA 2021 SBOM baseline, co-authored with NSA, FBI and 15 international agencies.

View

2026-minimum-elements-for-a-software-bill-of-materials-sbom

PDF

Cybersecurity in Medical Devices: Quality System Considerations and Premarket Submissions (FDA, Feb 2026)

FDA guidance on the cybersecurity design, documentation and SBOM content expected in premarket submissions.

View

fda-guidance-cybersecurity-feb-2026

PDF

Managing Challenges in SBOM Data Normalization (MITRE, Apr 2026)

MITRE considerations for normalizing SBOM data so component and vulnerability records can be compared and trusted.

View

mitre-considerations-for-managing-challenges-in-software-bill-of-materials-sbom-data-normalization-apr-2026

PDF

Validating Medical Device Cybersecurity Through Penetration Testing (MDIC, Jun 2026)

MDIC best practices, co-authored with FDA staff, for planning, running and reporting device penetration tests.

View

mdic-validating-medical-device-cybersecurity-through-penetration-testing-june-2026

Questions

Does CISA 2026 replace the NTIA 2021 minimum elements?

Yes. CISA says the 2026 document updates and replaces the NTIA version while keeping its core principles.

Are the minimum elements legally binding?

Not on their own. CISA states they “do not create new requirements.” For medical devices, the SBOM requirement comes from section 524B of the FD&C Act for cyber devices, and FDA's guidance sets out what to include.

Does FDA expect the CISA 2026 fields?

FDA's February 2026 guidance points to the NTIA baseline. The CISA 2026 list covers those fields under new names and adds hashes, licenses and generation context, so building to the 2026 list now is the safer choice.

Which SBOM format should we use?

SPDX or CycloneDX. CISA no longer lists SWID tags, and FDA encourages industry-accepted formats.

How deep does the SBOM need to go?

All components, including transitive dependencies. CISA 2026 removed the old minimum depth.

Does the EU Cyber Resilience Act apply to our device?

Not if it falls under the MDR or IVDR. Article 2(2) of the CRA excludes those products, so the MDR or IVDR and MDCG 2019-16 apply instead.

General information, not legal or regulatory advice.

Sources

CISA, 2026 Minimum Elements for a Software Bill of Materials (Jul 29, 2026)
NTIA, The Minimum Elements for a Software Bill of Materials (Jul 12, 2021)
FDA, Cybersecurity in Medical Devices, Quality System Considerations and Content of Premarket Submissions (Feb 3, 2026), section V.A.4
Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 2
IMDRF N73, Principles and Practices for SBOM for Medical Device Cybersecurity (2023)

Preparing the SBOM and cybersecurity documentation for a submission? Talk it through with Cosm.

Talk to Cosm