CISA’s new SBOM standards go beyond checkbox security

CISA has proposed the first major update to SBOM minimum elements since 2021, adding required fields (e.g., component hash, license, tool name, and generation context) to improve integrity verification, provenance tracking, and operational usability; public comments are open until October 3, 2025. The draft signals rising federal expectations and will push enterprises and vendors to enhance CI/CD pipelines, signing and attestation, coverage metrics, and alignment with SPDX/CycloneDX, while experts note gaps (transitive dependencies, explicit signing rules, runtime SBOMs) and urge integration with VEX and CSAF to ensure SBOMs drive actionable risk reduction rather than compliance noise.