Software bill of materials (SBOM)

FDA expects an SBOM in the premarket cybersecurity documentation of cyber devices, so that vulnerabilities in third-party and open source components can be tracked over the device's life. Its value depends on keeping it current as the software changes.

a formal inventory of software components and dependencies, information about those components, and their hierarchical relationships. The software components in an SBOM include, but are not limited to, commercial, open source, off-the-shelf, and custom software components. See Section V.A.4 for a more complete description of an SBOM.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology