Update compliance pages for CISA 2026 SBOM Minimum Elements - #142
Merged
vpetersson merged 1 commit intoAug 31, 2026
Merged
Conversation
vpetersson-bot
force-pushed
the
compliance-cisa-2026-elements
branch
from
August 31, 2026 19:02
111d60d to
dbc6321
Compare
CISA published the 2026 Minimum Elements for a Software Bill of Materials on 29 July 2026, together with the NSA, FBI and fifteen international partner agencies. It updates and replaces the NTIA 2021 minimum elements. Our compliance pages still described the 2025 version as an unfinalised public comment draft and the NTIA 2021 elements as the operative baseline. Both statements are now incorrect. - Rewrite /compliance/cisa-minimum-elements/ around the final 2026 document: all 23 elements across SBOM Metadata (9), Component Data (8) and Practices and Processes (6), with definitions quoted from Appendix A and the full change log from Appendix B. - Mark /compliance/ntia-minimum-elements/ as superseded, add a banner and a 2021 to 2026 field mapping. The page is kept for historical reference. - Add a CISA 2026 format-mapping section to the schema crosswalk covering SPDX 2.3, SPDX 3.0, CycloneDX 1.6 and CycloneDX 1.7. - Correct stale references in the compliance index, CISA framing page, NTIA/CISA compliance FAQ, SBOM examples and the action docs. - Add a forward-pointing note to the August 2025 news post announcing the draft. The post itself is left intact as a dated record. Element names, definitions and change statuses are taken from the CISA document. Format mappings come from an OpenSSF working document produced with the SPDX and CycloneDX communities, and are attributed as in-progress community guidance rather than a ratified standard. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Eb2uMFkkbVviAV9PBVikPj
vpetersson-bot
force-pushed
the
compliance-cisa-2026-elements
branch
from
August 31, 2026 21:13
dbc6321 to
722f16a
Compare
vpetersson
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CISA published the 2026 Minimum Elements for a Software Bill of Materials on 29 July 2026, together with the NSA, FBI and fifteen international partner agencies. In its own words the document "updates and replaces" the NTIA 2021 minimum elements.
Our compliance pages had not caught up. They still described the 2025 version as an unfinalised public comment draft, and
/compliance/ntia-minimum-elements/stated that the NTIA 2021 elements "remain the operative baseline". Both statements have been incorrect for a month.Changes
/compliance/cisa-minimum-elements/— rewritten around the final document. Covers all 23 elements in three groups: SBOM Metadata (9), Component Data (8), and Practices and Processes (6). Definitions are quoted from Appendix A; the change log comes from Appendix B. Adds a section on the details most likely to affect an existing SBOM pipeline — RFC 9557 timestamps, Coverage having no minimum depth, SWID Tags dropped from the named formats, and the unknown-versus-withheld distinction./compliance/ntia-minimum-elements/— retained as a historical reference, with a superseded banner and a table mapping each of the seven 2021 fields to its 2026 successor. All seven survive; four were renamed./compliance/schema-crosswalk/— new section mapping the 17 CISA 2026 data fields to SPDX 2.3, SPDX 3.0, CycloneDX 1.6 and CycloneDX 1.7.Stale references corrected in
/compliance/,/compliance/cisa-framing/,/faq/how-do-i-achieve-ntia-cisa-compliance/,/sbom-examples/and/sbomify-action/why/.August 2025 news post — left intact as a dated record, with an update note pointing to the final version.
Sourcing
Element names, definitions and change statuses are taken from the CISA PDF. The counts (10 new, 8 major updates, 5 minor updates, 1 removal) match the document's own "Notable Updates" summary.
Format mappings come from an OpenSSF working document produced with the SPDX and CycloneDX communities. That work is still in progress, so the page attributes it as community guidance rather than a ratified standard and advises verifying against the format specifications.
Worth a reviewer's eye
The crosswalk now contains two mappings that disagree, and this is deliberate rather than an oversight. The existing table maps NTIA "Supplier Name" to
components[].supplier.name. The OpenSSF mapping for CISA 2026 "Component Producer" usesmanufacturer.nameorauthors[].nameinstead, because Component Producer denotes the entity that originated the software rather than the one that supplied it. Both are shown with a note explaining the difference. Someone familiar with how our generator populates those fields should decide whether we recommend one.Verification
hugo --minify --environment productionbuilds cleandprint checkpassesd2lint not run: not installed in this environment, and no.d2files are touched by this PR🤖 Generated with Claude Code
https://claude.ai/code/session_01Eb2uMFkkbVviAV9PBVikPj