DevKit Dossier

What your SBOM contains

This is an example. The file behind it is a small sample we wrote for this page.

We read a CycloneDX 1.6 file. Components: 12.

It says it was created on 1 October 2026.

The NTIA minimum elements

These are the data fields listed in "The Minimum Elements For a Software Bill of Materials (SBOM)", published by the US Department of Commerce and NTIA on 12 July 2021.

  • Supplier name: present in 7 of 12 components
  • Component name: present in 12 of 12 components
  • Version: present in 11 of 12 components
  • Other unique identifiers (package URL): present in 9 of 12 components
  • Dependency relationships: 12 stated
  • Author of SBOM data: Example Devices
  • Timestamp: 2026-10-01T09:00:00Z

What the Cyber Resilience Act asks an SBOM to cover

Annex I, Part II, point (1) of Regulation (EU) 2024/2847 asks manufacturers to:

identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products;

  • The file names the product it describes: Sample Gateway.
  • Direct dependencies of that product, stated in the file as dependency relationships: 5.

The Act names no particular format; it asks for a commonly used, machine-readable one. Article 13(24) lets the Commission specify the format and elements of the SBOM by implementing acts.

What can be watched for vulnerabilities

Vulnerability data is matched to a component through its package URL.

  • Components with a package URL that DevKit Dossier can match against public vulnerability data: 7 of 12.
  • Without a package URL: 3.
  • Of a package type DevKit Dossier does not match yet: 1.
  • Without a version: 1.

What we could not read cleanly

Nothing: every entry was read.

One check is a snapshot. New vulnerabilities appear every day.

DevKit Dossier keeps the SBOM of every release, compares it with new vulnerabilities every day and keeps the record with its timestamps. It supports your evidence; it does not replace your own assessment.

Check another file

Not sure what the CRA asks of an SBOM? Read the guide.

The report counts what the file contains. It is not a statement of conformity and it is not legal advice.