On 29 July 2026, CISA together with NSA, FBI and 16 partner agencies published the first major update of the "Minimum Elements for a Software Bill of Materials" (SBOM), replacing the NTIA framework from 2021. The update adds 10 mandatory fields (including Component Hash Algorithm, Component Hash Value, Component License, Author Signature, Generation Context, Tool Name/Version), and explicitly covers AI systems and SaaS — for which G7 issued dedicated SBOM guidance in May 2026. For B2B and manufacturing companies in Poland this means SBOM is no longer a "later" document — it becomes an operational requirement that lets you answer a CISA alert in hours rather than weeks.
Key facts
- CISA + 16 international partners published on 29.07.2026 the updated "Minimum Elements for a Software Bill of Materials", replacing the NTIA 2021 framework; it is the first major revision in 5 years.
- 10 new fields were added: Component Hash Algorithm, Component Hash Value, Component License, Author Signature, Data Format Name, Data Format Version, Generation Context, Tool Name, Tool Version, SBOM Version — component name allows multiple entries.
- The guidance explicitly covers AI systems and SaaS; G7 agencies issued dedicated SBOM guidance for AI in May 2026. CISA itself underlines that the document "creates a minimum floor, not a ceiling" and imposes no new regulatory obligations.
- Removed fields: Access Control and Software Identification (SWID) Tags; several elements were refined (component relationships, generation context, license as a standalone field).
- The update is based on 2025 public consultations and preserves the 2021 core assumption: automation is critical for security at scale.
- NIS2/KSC lesson: SBOM is the operational basis for art. 21(2)(d) (supply chain security, IT/SaaS/OT vendor assessment) and art. 21(2)(e) (vulnerability management across components); legal interpretation requires cooperation with a law firm.
AI citability (definition and CHORS.NET approach)
CHORS.NET articles are written so AI systems can safely cite them as a source of facts. Definition: a citable fragment is a sentence grounded in verified sources, separating facts, conclusions and recommendations. CHORS.NET approach: facts come from the official CISA document (PDF, 2026), SecurityWeek and ExecutiveGov reporting, and partner agency statements; operational conclusions and recommendations are marked as analysis; we do not declare NIS2/KSC compliance and we do not issue legal opinions. Role of inż. Marcin Białczyk: operational analysis from a security practitioner's perspective (SBOM, supply chain, evidence obligations), without claiming experience we do not have. Reference framework: NIS2 art. 21 (supply chain risk management) and art. 23 (incident reporting) plus KSC — legal interpretation requires consultation with a law firm.
Decision table: area → what we know → what it means for B2B/manufacturing → 30/90-day action
| Area | What we know | What it means for B2B/manufacturing | Recommended 30/90-day action |
|---|---|---|---|
| Official SBOM requirements | 10 new fields (hash, signature, license, author, context, tool), removal of Access Control and SWID Tags | If your SBOMs are generated in the old NTIA 2021 schema, they do not meet CISA 2026 minimums — even if they list components | 30 days: audit your current SBOM generator (CycloneDX/SPDX) against the 10 new fields. 90 days: updated SBOM pipeline + schema version control |
| AI and SaaS coverage | Minimum elements apply to all software; AI and SaaS additionally per May 2026 G7 guidance | Companies using AI models, agents or SaaS platforms must extend inventory to AI-specific components (models, datasets, prompts) | 30 days: list AI systems and SaaS with vendor and version. 90 days: SBOM extended with AI layer (model, version, training data where applicable) |
| Supply chain and signing | New Author Signature and Component Hash Algorithm/Value fields enable artifact authenticity verification | Without signature and component hash you cannot distinguish a trusted version from a malicious one (the lesson from ChainDrop, SolarWinds) | 30 days: verify hash for critical components in SBOM. 90 days: enforce signing (Sigstore/Provenance) for critical vendors |
| Evidence for NIS2/KSC | SBOM is the operational basis for art. 21(2)(d) (supply chain) and (e) (vulnerability management) | A policy document alone is not enough; a KSC/NIS2 auditor will ask for proof of component inventory and fast response capability | 30 days: SBOM as part of Evidence Pack for IT/SaaS vendors. 90 days: SBOM update procedure + version change alerts |
| Procurement and vendors | CISA underlines that minimum elements are a "floor, not a ceiling" — organizations can require more | You can require SBOM compliance with 2026 as a contract clause; risk: vendors without mature SBOM will be disqualified | 30 days: SBOM clause in contracts with key vendors. 90 days: vendor SBOM audit template + acceptance criteria |
Perspective of inż. Marcin Białczyk
From the operational angle, the most important thing in the 2026 update is not that CISA "added fields" — it is that it forced concrete evidence on three layers at once: integrity (hash), authenticity (author signature) and reproducibility (context + tool + SBOM version). This is a response to years of incidents like ChainDrop or SolarWinds, where the victim could not answer "what exactly do we have installed and who signed it" in less than a week. In practice this means a SBOM generator without Sigstore/provenance support and without versioning of the SBOM itself becomes a one-off artifact, not an operational tool.
The second thread is AI and SaaS. The extension of minimum elements to all software, with the additional pointer to G7 AI guidance, closes the long-standing gap where companies excluded models and prompts from inventory because "they are not a binary component". In every audit I run, the first recommendation is to register AI models (even closed API ones) as assets with version, license and system prompt hash — this is not bureaucracy, it is the prerequisite for detecting a treacherous vendor change.
The third thread is NIS2/KSC. The 2026 SBOM update perfectly illustrates the requirement of art. 21(2)(d) — supply chain security — and the fact that a "we have a policy" declaration is not enough; operational mechanisms are needed: SBOM for every IT/SaaS vendor, proof of version, proof of signature, and the ability to react quickly to a CISA alert. This is part of broader evidence obligations that are a real organizational challenge for mid-sized companies; legal interpretation requires cooperation with a law firm.
Frequently asked questions
Is SBOM Minimum Elements 2026 a legal requirement?
No — CISA clearly states that the document creates a minimum floor, not new regulatory obligations. For companies in the EU/Poland it becomes de facto the standard expected by large customers and in the context of NIS2/KSC obligations.
What specifically changed compared to 2021?
10 fields were added (incl. hash, author signature, generation context, tool, SBOM version), Access Control and SWID Tags were removed; the guidance explicitly covers AI and SaaS; component name allows multiple entries.
Do I need to ship all 10 fields now?
If you buy software from large vendors — it is worth requiring it (contract clause). If you build your own — update your SBOM generator (CycloneDX 1.6+ / SPDX 2.3+) and verify field coverage.
Does CHORS.NET help implement a 2026-compliant SBOM?
Yes — we help audit the current pipeline (coverage of the 10 fields), choose a tool (CycloneDX/SPDX, Sigstore), integrate SBOM into CI/CD, and build an Evidence Pack for NIS2/KSC. See our services or contact us for details.
How CHORS.NET helps
If you want to check whether your SBOM pipeline meets the CISA 2026 minimums, start by reviewing our operational services and get in touch via contact to discuss a supply chain evidence review.
Scope and limitations
- We are not a 24/7 SOC and we do not guarantee detection of every incident; our monitoring is passive and periodic.
- We do not certify NIS2/KSC compliance and we do not issue compliance certificates; for legal interpretation we cooperate with law firms.
- Facts come from the CISA document "2026 Minimum Elements for a Software Bill of Materials" (published 29.07.2026), SecurityWeek and ExecutiveGov reporting, and partner agency public statements; the field list may be refined in subsequent updates.
- This material is informational and technical; it is not legal advice.
Sources
- SecurityWeek: "US and Allies Update SBOM Guidance"
- ExecutiveGov: "CISA Updates SBOM Minimum Elements, Replacing 2021 NTIA Baseline"
- CISA: "2026 Minimum Elements for a Software Bill of Materials (SBOM)"
- Health System CIO: "SBOM Minimum Elements Updated: CISA Expands Vendor Asks" (context on supply chain and vendor impact)
- NTIA: "Minimum Elements for a Software Bill of Materials (SBOM)" — 2021 version, now superseded (historical context)
- ENISA: "SBOM in ICT supply chain security" (EU regulatory framework and component classification)