CycloneDX currently supports hardware only through the device component type and the property taxonomy. Everything beyond naming a component as a device, such as its classification, physical placement, package style, procurement characteristics, certifications, and part identity, must be expressed through namespaced properties, which are not machine comparable across producers and carry no validation. There is a need to add first class hardware support to the specification.

The CycloneDX Hardware Feature Working Group (FWG) analyzed the CISA Hardware Bill of Materials Framework (HBOM) for Supply Chain Risk Management and other industry documents, and invited experts from across the manufacturing industry to present their use cases, which were captured and drove the design.

The FWG proposes first class support in the following areas:

• Physical attributes on components of type device: hierarchical classification with codes from external taxonomies (for example HS, NAICS, JEDEC, ECCN), board location with reference designators, package and mounting style, and supplier lead time, restricted to device components and enforced by the schema.
• Certifications on any component, hardware and software alike, covering the standard or scheme, certificate identifier, issuer, validity dates, scope, jurisdiction, and level, with an optional tie to CycloneDX Attestations (CDXA) claims that substantiate the certification.
• Identity substantiation for physical parts through the unified evidence model: visual inspection, x ray inspection, electrical testing, material analysis, and decapsulation as analysis techniques, and photographs as supporting evidence, addressing counterfeit detection and part authenticity.
• Party attributed identifiers for physical parts, including manufacturer part numbers, serial numbers, GTINs, and related schemes.