Skip to content

Without a mandate behind it, the new software bill of materials baseline still belongs in vendor contracts.

CISA, the NSA, the FBI, and fifteen international partner agencies published a sharper software bill of materials baseline on July 29, 2026, the same month the mandate that used to sit behind it was already gone. The field set is worth adopting anyway.

The thesis: the mandate left, and the baseline got better anyway.

On January 23, 2026, the Office of Management and Budget issued Memorandum M-26-05, Adopting a Risk-based Approach to Software and Hardware Security. It rescinded two Biden-era memoranda, M-22-18 and M-23-16, that had required federal agencies to collect a standardized self-attestation from software producers before using their products, and it handed the decision back to each agency’s own risk judgment and contract language. Six months later, on July 29, 2026, CISA published a new baseline anyway: the 2026 Minimum Elements for a Software Bill of Materials, co-authored with the NSA, the FBI, and fifteen international partner cyber agencies, finalizing a draft that had been open for public comment since August 2025.

Put those two facts together and the shape of the opportunity is clear. The rule that used to force a specific attestation form is gone. The document that says what a good software bill of materials should actually contain got more detailed in the same year. A procurement or vendor master data team does not need a mandate to start requesting the sharper version, because the sharper version is now the public standard everyone else will eventually be measured against.

What actually changed, field by field.

NTIA’s original July 2021 baseline defined seven data fields: Supplier Name, Component Name, Version of the Component, Other Unique Identifiers, Dependency Relationship, Author of SBOM Data, and Timestamp. Those fields are still the skeleton of a bill of materials. The 2026 CISA baseline keeps that skeleton and adds the fields a vendor master data record actually needs to make the document useful rather than decorative.

FieldStatus in 2026Why it matters for procurement
Component ProducerRenamed from Supplier NameA vendor record now needs to distinguish who produced a component from who sold or integrated it, which are often different companies
Component Hash Value and AlgorithmNew in 2026Lets a procurement or security reviewer confirm a delivered SBOM actually describes the software received, not a description of it
Component LicenseNew in 2026Turns license exposure into a field a contract or legal team can query across the vendor book, not a fact buried in a PDF
Component IdentifiersExplicit CPE and Package URL calloutMakes a component locatable in vulnerability and license databases without a manual lookup step
SBOM Author SignatureNew in 2026Adds an authenticity check on the document itself, separate from the authenticity of the software it describes
Unknown or withheld dataNew explicit fieldForces a documented answer of not disclosed instead of a silently missing row, so a reviewer can tell the two apart
DepthReplaced by an explicit full-dependency requirementA 2026 SBOM has to include transitive dependencies rather than a vendor choosing how far down the tree to go
ScopeExtended to open source, AI systems, and SaaSThe baseline now names software categories that a build pipeline alone cannot fully describe

Mitch Ashley of The Futurum Group put the scope change in operating terms: extending the baseline to AI and SaaS, he noted, moves the work from a build pipeline to a vendor contract. That single observation is the reason this belongs on a procurement and finance blog rather than only a security one.

Software you build, and software you buy, need different requests.

An engineering team that owns its own build pipeline can generate a bill of materials automatically, every time it ships. That has been true since roughly the 2021 baseline and is well supported by existing tooling. The gap the 2026 scope expansion exposes is what happens when there is no pipeline of your own to ask, because the software in question is a SaaS platform, a hosted AI model, or any other fully managed product a vendor operates on your behalf.

DimensionSoftware you buildSoftware you buy
Where the SBOM originatesGenerated automatically at build time from your own dependency graphHas to arrive as a deliverable from the vendor, since there is no local build step to generate one
Who owns the requestEngineering and application security, as part of the release pipelineProcurement and vendor master data, as part of onboarding and contract renewal
Where it should liveCI/CD artifact storage, tied to a build or release identifierThe vendor master record, tied to a supplier and contract identifier
Refresh triggerEvery build, so staleness is rarely the riskA vendor release, contract renewal, or scheduled review, so a refresh cadence has to be set deliberately
Audit evidence neededA build log linking the SBOM to the shipped artifactProof the request was made, the document was received, and its hashes were checked against what was delivered
Software you build and software you buy reach the same vendor master data record by different pathsSoftware built in-house generates its bill of materials automatically inside the build pipeline. Software bought from a vendor, including AI and SaaS products, has no equivalent build step, so its bill of materials has to arrive as a contract deliverable instead. Both paths should land in the same vendor master data record, where the format, hash verification status, and refresh date are checked before a security or audit review.Software you buildGenerated automaticallyby the build pipeline.Software you buyIncluding AI and SaaS.No build step of your own.ARRIVES AS A CONTRACT DELIVERABLEVendor master data recordFormat, hash status,and refresh date checked.Security and audit reviewSame check, whether thesoftware was built or bought.One record, two paths in, and a refresh date that keeps either one from going stale.
Based on the delivery-model distinction implicit in the 2026 CISA baseline’s expanded scope to AI systems and SaaS, which have no local build pipeline of the buyer’s own.

The vendor master data field set worth building now.

None of this requires new security technology. It requires the same discipline finance and procurement teams already apply to a W-9, an insurance certificate, or a banking detail: a defined field on the vendor record, a named owner, and a refresh date, rather than a document that arrives once by email and is never looked at again.

Vendor identifier

The software vendor this row belongs to, tied to the same identifier used in the vendor master record and AP system.

SBOM required tier

Whether this vendor’s risk classification requires an SBOM at all, and how often it needs to be refreshed.

Delivery mechanism

Contract deliverable, self-service portal, or upon-request only, since that determines who has to ask and how often.

Format received

CycloneDX, SPDX, or another format, so the record states what was actually delivered rather than assuming a standard.

Baseline referenced in contract

Whether the current contract clause cites the 2026 CISA baseline or still cites the retired 2021 NTIA elements.

Hash verification status

Verified, pending, or failed, confirming the delivered SBOM’s hashes match the software actually received.

Unknown-component disclosure

Whether the vendor explicitly marked any components as unknown or withheld, rather than the field being silently blank.

Next refresh due

The date this vendor’s SBOM is due for another request, set by risk tier rather than left to memory.

The record one vendor relationship needs.

A structured record like the one below, held on the vendor master data itself rather than in a separate security spreadsheet, keeps the SBOM status visible to procurement, AP, and security at the same time, which is where the three functions usually lose track of each other today.

Example vendor master data record with SBOM fields

{
  "vendor_id": "vnd-04821",
  "vendor_name": "example software vendor",
  "delivery_model": "saas",
  "sbom": {
    "required_tier": "high",
    "delivery_mechanism": "contract_deliverable",
    "format_received": "cyclonedx_1.6",
    "baseline_referenced": "2026_cisa_minimum_elements",
    "hash_verification_status": "verified",
    "unknown_components_disclosed": 2,
    "last_received": "2026-08-04",
    "next_refresh_due": "2027-02-04"
  },
  "contract_clause_version": "v3_2026_baseline",
  "reviewed_by": "Vendor risk and procurement lead"
}

Justin Beals of Strike Graph makes the staleness risk concrete: an SBOM is a snapshot, and few organizations can prove the components it lists are still accurate six months later. The next_refresh_due field is what turns that observation into something a vendor record can act on automatically, rather than something a reviewer has to remember to check.

Implementation checklist.

Add an SBOM field set to every software vendor’s master record: required tier, delivery mechanism, format received, hash verification status, and next refresh due, so the answer is a query rather than an email search.

For any vendor onboarding or renewal after July 29, 2026, update the contract’s SBOM clause to cite the 2026 CISA baseline instead of the retired 2021 NTIA elements, since the two lists of fields are not the same.

For AI and SaaS vendors specifically, add the SBOM request to the RFP or renewal questionnaire itself, in the sections already used for other vendor requirements, since there is no local build pipeline to generate one on your side.

Set a refresh cadence by vendor risk tier rather than treating one onboarding-time SBOM as good indefinitely, since the document describes a build state that ages the moment the vendor ships a new release.

Require any component a vendor marks unknown or withheld to be flagged as its own field in the vendor record, not accepted as if the component simply were not present.

Route incoming SBOMs to whatever vulnerability-monitoring tooling already covers internally built software, so a purchased dependency gets the same ongoing check as one your own engineers wrote.

Confirm with procurement and vendor master data platforms whether they can parse a CycloneDX or SPDX file into structured fields, rather than storing it only as an opaque attachment.

Decide in writing, for security-sensitive vendor categories, whether a missing or stale SBOM is a payment-release gate or a best-effort ask, so AP applies one rule instead of an inconsistent one, vendor by vendor.

Start with the highest-risk software vendors, the ones handling sensitive data or embedded deep in a critical workflow, since that is where a hash mismatch or an undisclosed component carries the most weight. Lower-risk vendors still need a register row, but the review can wait a cycle.

Constructive failure modes to design around.

Reading a voluntary baseline as not applicable outside federal contracting, and missing the chance to adopt the sharper field set as a private due-diligence standard before any customer or regulator asks for it directly.

Requesting an SBOM once at onboarding and treating it as permanent, when the document describes a build state that a vendor’s next release can make stale within months.

Accepting a component marked unknown the same way as a component that simply is not listed, losing the exact distinction the 2026 baseline’s new unknown-data field was built to preserve.

Applying the same request to every vendor regardless of delivery model, asking a fully managed AI or SaaS provider for a build-pipeline artifact that provider has no equivalent process to generate.

Filing a received SBOM as an unlinked attachment in a shared drive instead of a field on the vendor master record, so the next security review or customer questionnaire starts from a manual search rather than a query.

Jeff Williams of OWASP and Contrast Security offered a fair caution: a sharper field set alone does not fix stalled adoption, and real change still needs market or regulatory pressure behind it. That is an argument for building the muscle now, while it is a competitive choice, rather than waiting until it is a compliance scramble.

What to ask procurement and vendor master data vendors now.

Can the vendor master record hold a structured SBOM field set, required tier, delivery mechanism, format, hash status, and refresh due date, rather than a free-text note or a loose attachment?

Does the platform parse CycloneDX or SPDX files into queryable data, or only store the uploaded document as an opaque file?

Can it flag a vendor’s SBOM as due for refresh automatically once it passes the cadence set for that vendor’s risk tier, rather than relying on a recurring calendar reminder?

Does the contract clause library already reference the 2026 CISA baseline, or does it still point to the retired 2021 NTIA minimum elements?

Can the system distinguish a vendor’s confirmed no known components from an SBOM request that was never answered, matching the new baseline’s explicit unknown-data field?

A platform that answers all five with a working feature has already built the structured path this baseline rewards, leaving the risk-tiering decision itself as the only judgment call left for procurement and security to make together.

Practical takeaway.

The 2026 Minimum Elements for a Software Bill of Materials is a voluntary baseline with no deadline attached, published in the same year the last mandatory attestation requirement behind it was rescinded. Treated as a compliance question, that combination looks like an easy one to defer. Treated as a vendor master data question, it looks like exactly the moment to build the field set once, before a customer questionnaire or a future rule asks for it under time pressure. The document itself is the argument: it already tells a procurement team what a complete answer looks like.

Sources.

Targeted searches for public X and Twitter commentary on the July 2026 CISA SBOM baseline and the January 2026 OMB rescission returned only trade-press, law-firm, and standards-body coverage, short of a credible set of two to four high-signal posts from a regulator or an independent practitioner. Ordinary citations are used instead, and nothing is fabricated.