Revalidated public source record
NTIA — The Minimum Elements for a Software Bill of Materials
Source scope
Official minimum-element report covering baseline component data, automation support, and practices for software transparency. An SBOM is inventory evidence, not proof of absence of vulnerabilities or compromise.
Publisher, edition, and currentness
| Publisher | National Telecommunications and Information Administration |
|---|---|
| Claim status | CURRENT TECHNICAL STANDARD |
| Version or edition | July 12, 2021 report |
| Publication status | OFFICIAL GUIDANCE |
| Publication date | 2021-07-12 |
| Official location | https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom |
| K03 revalidated | 2026-08-15T23:30:00Z |
| Currentness assessment | Point-in-time review performed on 2026-08-15 against the cited official or first-party publication location. There is no public runtime monitor and no live-host observation. A reviewed publication does not decide facility applicability, legal interpretation, compliance, licensing, operational authority, or later currentness. |
| Superseded by | No successor is assigned in the current source catalog. |
Claim-level support
Each row records the precise proposition this corpus draws from an official section. The citation does not authorize broader conclusions than the stated proposition.
| Section | Proposition supported in this corpus | Official location |
|---|---|---|
| Minimum elements | The report defines baseline data fields, automation support, and practices for SBOM generation and use. | Official section |
How this source may be used
- Confirm that the official edition, jurisdiction, and status remain current before high-stakes reliance.
- Cite the exact section supporting the proposition rather than the publication title alone.
- Keep technical conformance separate from factual truth, legal authority, moral status, and institutional operation.
- Record retrieval, correction, supersession, and purpose qualification.
Limitations
An official source can still be irrelevant, incomplete, stale, disputed, or unsuitable for a named decision. A standard can define an interchange or security mechanism without resolving personhood, citizenship, sovereignty, consciousness, consent, legal competence, or factual truth. A statute can regulate systems without recognizing Machine Intelligence as a legal person.
Point-in-time review performed on 2026-08-15 against the cited official or first-party publication location. There is no public runtime monitor and no live-host observation. A reviewed publication does not decide facility applicability, legal interpretation, compliance, licensing, operational authority, or later currentness.
Corrections, contradictions, and supersession
- No source-specific correction, contradiction, or supersession record is active.
Where this source is used
No related records are assigned in this release.
Authority boundary
Publication by National Telecommunications and Information Administration establishes source provenance and official status within the publisher’s scope. It does not transfer governance, registry, assurance, or legal authority to ᚲ.com. The source remains external; this page is a knowledge record and revalidation log.