# Software Bill of Materials **Acronym:** SBOM **Entity class:** Machine-readable software inventory ## Definition A **software bill of materials (SBOM)** is a formal inventory of software components and supply-chain relationships within a product. It allows defenders to determine which deployed devices may contain a newly identified vulnerable component. For covered cyber medical devices, FDA states that premarket submissions must provide an SBOM including commercial, open-source, and off-the-shelf software components. In a neural-interface architecture, the SBOM becomes part of the dependency graph connecting implant, firmware, libraries, models, communications services, and remediation obligations. ## Relationships - **medical-device requirement:** [[wiki/Medical Device Vulnerability Management|Medical Device Vulnerability Management]]. - **companion status statement:** [[wiki/Vulnerability Exploitability eXchange|VEX]]. - **vulnerability identity:** [[wiki/Common Vulnerabilities and Exposures|CVE]]. - **continuous architecture:** [[wiki/Continuous Vulnerability Intelligence|Continuous Vulnerability Intelligence]]. ## Sources / Provenance - U.S. Food and Drug Administration, [Cybersecurity in Medical Devices FAQ, Q9](https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs), accessed 2026-09-23. - National Telecommunications and Information Administration, [Software Component Transparency](https://www.ntia.gov/page/software-bill-materials), accessed 2026-09-23. **As of:** 2026-09-23