CISA’s 2026 SBOM Guidance Adds Hash Requirements and AI Coverage

The Cybersecurity and Infrastructure Security Agency (CISA) has released updated guidance for software supply chain security, specifically focusing on Software Bill of Materials (SBOM) requirements. This revision, coordinated with the NSA, FBI, and international partners, updates the previous 2021 guidance and incorporates feedback from over 90 comments.

The most significant changes include the expansion of scope to cover all software types, including open-source software, AI software, and software-as-a-service (SaaS). Additionally, the guidance now requires additional data fields, such as component hash algorithm, component license, SBOM tool name, and SBOM generation context. The introduction of a hash requirement in every SBOM addresses a critical gap in verifying the actual contents of software components, ensuring that what is documented matches what is deployed.

While the minimum elements apply to all software, certain types like AI and cloud-based SaaS may require additional elements. This extension poses a practical challenge, as SBOMs for these types cannot be generated through traditional build pipelines and must instead be integrated into vendor contracts. The update also aligns with a companion document released by CISA and G7 partners, focusing on AI systems.

However, a deeper issue remains: the lack of ongoing validation of the components listed in SBOMs. As SBOM requirements become more integrated into frameworks like CMMC and FedRAMP, there is a growing concern that a static list, once generated, may not effectively prove ongoing security. Federal enforcement is shifting towards a risk-based approach, emphasizing the importance of well-structured minimum elements guidance.

For practitioners, the update primarily involves adding hash values to existing SBOM formats, such as CycloneDX or SPDX, with the more significant challenge lying in handling AI models, datasets, and SaaS components, which require a different approach beyond automated pipeline automation. Ultimately, the key to success lies in building continuous validation into SBOM processes, moving beyond mere attestation to provide tangible evidence of ongoing security.