What does SBOM stand for?
SBOM stands for Software Bill of Materials. A software bill of materials: an inventory of the components and versions inside a piece of software, so you can tell quickly whether a newly disclosed vulnerability affects you.
An SBOM is a formal list of everything a piece of software is made of: each library and component, its version and its supplier, including the dependencies of the dependencies. Modern applications are mostly assembled from third-party parts, and without a list nobody can say quickly whether a newly announced vulnerability affects them. With an SBOM, the answer is a search. SPDX and CycloneDX are the common formats.
SBOM in practice: an example
A critical vulnerability is announced in a widely used logging library. A company that keeps an SBOM for each product searches them and has, within the hour, the list of the nine products that contain an affected version. A company without them spends days asking each team and each vendor.
What SBOM is confused with
SBOM vs SCA: what is the difference?
Software composition analysis is the tooling that scans code to find its open-source components and their known vulnerabilities. The SBOM is the inventory document; SCA tools often produce and consume it.
SBOM vs CVE: what is the difference?
A CVE identifies one known vulnerability. An SBOM lists components. Matching the two tells you which of your products are affected. What CVE stands for
Which exams cover SBOM?
SBOM is on the official CompTIA acronym list for one of the four exams covered here.
- CySA+ CS0-004: 2.4 (Vulnerability Management).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A new vulnerability is published in an open-source library. Which document lets a company find out quickly which of its applications include that library?
- An acceptable use policy
- An SBOM
- A network diagram
- A service-level agreement
Show the answer
B. An SBOM. The SBOM lists the components and versions inside each application, so affected products can be found by searching it.
2. What does an SBOM contain?
- The source code of the application
- The components and dependencies of the software, with versions and suppliers
- The passwords of the developers
- The firewall rules of the build server
Show the answer
B. The components and dependencies of the software, with versions and suppliers. It is an inventory of ingredients, not the code itself and not configuration or credentials.
Sources: NTIA: Software Bill of Materials; NIST: Software Security in Supply Chains, Software Bill of Materials (SBOM); NIST glossary: software bill of materials. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.