OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. The specification supports:

• Software Bill of Materials (SBOM)
• Software-as-a-Service Bill of Materials (SaaSBOM)
• Hardware Bill of Materials (HBOM)
• Machine Learning Bill of Materials (ML-BOM)
• Cryptography Bill of Materials (CBOM)
• Manufacturing Bill of Materials (MBOM)
• Operations Bill of Materials (OBOM)
• Vulnerability Disclosure Reports (VDR)
• Vulnerability Exploitability eXchange (VEX)
• CycloneDX Attestations (CDXA)

The CycloneDX project provides standards in XML, JSON, and Protocol Buffers, as well as a largecollection of official and community supported toolsthat create or interoperate with the standard.

The project's website has many documenteduse cases and examplesthat provide a springboard to SBOM adoption.

The project operates as ameritocracywhoseguiding principlesreinforce itsrisk-based approach to standards development.The project encouragescommunity participationin the development of thestandard and supporting tools.

Modern software is assembled using third-party and open source components. They are glued together in complex andunique ways and integrated with original code to achieve the desired functionality. An accurate inventory of allcomponents enables organizations to identify risk, allows for greater transparency, and enables rapid impact analysis.

CycloneDX was created for this purpose.

Strategic direction and maintenance of the specification is managed by the CycloneDX Core Working Group,is backed by theOWASP Foundation,and is supported by the global information security community.

Repositories

Most used topics