specification

Overview of specification

What it is

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. It is an Ecma International standard published as ECMA-424. The specification is developed by the OWASP Foundation and Ecma International Technical Committee for Software & System Transparency (TC54). CycloneDX supports multiple BOM types including Software Bill of Materials (SBOM), Software-as-a-Service Bill of Materials (SaaSBOM), Hardware Bill of Materials (HBOM), Machine Learning Bill of Materials (ML-BOM), Cryptography Bill of Materials (CBOM), Manufacturing Bill of Materials (MBOM), Operations Bill of Materials (OBOM), Vulnerability Disclosure Reports (VDR), Vulnerability Exploitability eXchange (VEX), and CycloneDX Attestations (CDXA).

Key features

• Full-stack BOM standard for cyber risk reduction across software, hardware, services, and AI/ML components.
• Supports multiple BOM types: SBOM, SaaSBOM, HBOM, ML-BOM, CBOM, VDR, VEX, and CDXA.
• Ecma International standard (ECMA-424) under a royalty-free patent policy.
• Official JSON Schema reference implementation available under Apache 2.0 license.
• IANA registered media types: application/vnd.cyclonedx+xml and application/vnd.cyclonedx+json.
• Recognized file patterns: bom.json, bom.xml, *.cdx.json, *.cdx.xml.
• Maintains a list of achievable use cases with examples in both XML and JSON.

Use cases

The CycloneDX project maintains a list of achievable use cases for supply chain risk reduction. Examples for each use case are provided in both XML and JSON formats. The specification is used for software composition analysis, vulnerability management, and ensuring transparency across the software supply chain.

Getting started

See the repository README for guidance on using the specification and schemas.

License and pricing

Licensed under the Apache License 2.0. Open source.

Based on the project's public README and repository metadata.