Concepts

Start here for standards, terminology, and encoding rules

Read these concepts before the detailed requirements.

Accepted specs (CycloneDX, SPDX, CSAF) and related quality frameworks.

Requirement levels, terminology, and roles used across the framework.

JSON-only rule and format alignment across SBOM, VEX, and VDR.

SBOM Requirements

Maturity levels, required metadata, component expectations, and dependency guidance

Standards and Frameworks

Normative references and standards underpinning the content requirements