CISA has published their 'Minimum Elements' document at https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf . It'd be good to evaluate the sbt-sbom output against the requirements in that document. I think we should be doing pretty well, but there's some unfortunate aspects where additional motivation/background/guidance might help.
For example: the document requires an "SBOM Author Signature". We do not (and should not) include a signature in the JSON/XML itself, but instead publish a detached signature along with the SBOM at publication time. I'm confident that meets the requirement, but might be good to call out explicitly.
CISA has published their 'Minimum Elements' document at https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf . It'd be good to evaluate the sbt-sbom output against the requirements in that document. I think we should be doing pretty well, but there's some unfortunate aspects where additional motivation/background/guidance might help.
For example: the document requires an "SBOM Author Signature". We do not (and should not) include a signature in the JSON/XML itself, but instead publish a detached signature along with the SBOM at publication time. I'm confident that meets the requirement, but might be good to call out explicitly.