What an SBOM contains
Component names, exact versions, suppliers and licences - for your own code, the RTOS or Linux distribution, vendor SDKs and HALs, bootloaders and open-source libraries.
The two common formats are SPDX and CycloneDX. Pick one that your tools and customers can consume.
Generate it in the build
- Yocto-based images can produce SPDX documents from the build metadata.
- Zephyr provides tooling to generate SPDX from a build.
- For bare-metal projects, record vendored components and versions in the build system and export them on release.
- Never maintain the SBOM by hand - it will drift from the real firmware.
Keep it useful
- Store the SBOM with every released firmware version.
- Check components against vulnerability databases regularly.
- Route new findings to the team that owns the product, with a deadline for assessment.
Why it matters for the CRA
From 11 December 2027 the CRA requires manufacturers to identify and document components, including an SBOM. Without it, answering "are we affected?" after a new vulnerability becomes slow and error-prone. See our cybersecurity & CRA service.