Compliance FrameworksInternational
OWASP CycloneDX BOM
CycloneDX BOM Standard: format compliance, inventory completeness, PURL, hash, license data.
CycloneDX BOM Standard: format compliance, inventory completeness, PURL, hash, license data.
| Short name | CDX BOM |
| Region | International |
| Country or scope | International |
| Sector | Application Security |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers CDX BOM
- Scan requirements: 7, all decided by a scan.
- Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for CDX BOM.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for CDX BOM and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
CDX-FORMAT Machine-Readable BOM Format | The BOM must be expressed in a conformant machine-readable format such as CycloneDX or SPDX rather than free-form documentation (CycloneDX specification / ECMA-424, format conformance) | Scan |
CDX-META BOM Metadata and Serial Number | A BOM should carry a unique serial number and creation timestamp in its metadata so document instances can be distinguished and versioned (CycloneDX 'serialNumber' and 'metadata.timestamp' fields) | Scan |
CDX-TOOLS BOM Creator Recorded | The metadata should record the tools or organization that created the BOM, providing provenance for the document itself (CycloneDX 'metadata.tools' / 'metadata.authors' fields) | Scan |
CDX-PURL Package URL Identity | Components should be identified with Package URLs so they can be located and cross-referenced across ecosystems (CycloneDX component 'purl' field) | Scan |
CDX-HASH Component Hashes | Components should include cryptographic hashes enabling integrity verification of the described artifacts (CycloneDX component 'hashes' field) | Scan |
CDX-LIC Component License Data | Components should declare their licenses using SPDX expressions or license objects (CycloneDX component 'licenses' field) | Scan |
CDX-DEPS Dependency Relationships | The BOM should describe the dependency graph relating components to one another and to the root component (CycloneDX 'dependencies' element) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
CDX-BOM-1 | Include Required BOM Metadata Fields |
CDX-BOM-2 | Declare Component Type and Scope |
CDX-BOM-3 | Include PURL and CPE for Components |
CDX-BOM-4 | Record Component Cryptographic Hashes |
CDX-BOM-5 | Declare Dependency Relationships |
CDX-BOM-6 | Include License Information for All Components |
CDX-BOM-7 | Document External Services in BOM |
CDX-BOM-8 | Attach Vulnerability Assertions via VEX |
CDX-BOM-9 | Capture Build Formulation in BOM |
CDX-BOM-10 | Sign and Verify BOM Documents |
Policy templates
Written for CDX BOM:
- CycloneDX BOM Authoring and Validation Policy
- Build Formulation and Reproducibility Policy (CycloneDX)
And 22 from the standard set, adapted to CDX BOM.