A software bill of materials (SBOM) is a list of software components that make up a software product.
Today, developers often use a combination of open source components and commercial software components from third-party vendors. The objective of an SBOM is to accurately list these components, providing software users visibility over what is included in a software product, and allowing them to avoid components that can be harmful for security or legal reasons. Most commonly, organizations are concerned about using software with components that have known security vulnerabilities, compromising software supply chain security.
The concept of BOM was traditionally used in manufacturing processes. Manufacturers use BOMs to keep track of the parts used to make a product. If defects are discovered in a specific part, a BOM makes it easy to find that part and resolve the problem. SBOM extends the same concept to software development, allowing software users and vendors to know which components are problematic and remediate them.