Specification Overview
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard formalized as ECMA-424, an international specification developed under the collaboration of the OWASP Foundation and Ecma International’s Technical Committee for Software & System Transparency (TC54). Its primary purpose is to enhance cyber risk reduction across complex supply chains by standardizing the representation of components, dependencies, and vulnerabilities in software, hardware, and AI/ML systems. The specification is maintained under a royalty-free patent policy and distributed under the Apache 2.0 license, ensuring broad accessibility and permissive reuse.
The standard supports a comprehensive range of BOM types, including Software Bill of Materials (SBOM), Software-as-a-Service Bill of Materials (SaaSBOM), Hardware Bill of Materials (HBOM), Machine Learning Bill of Materials (ML-BOM), Cryptography Bill of Materials (CBOM), Manufacturing Bill of Materials (MBOM), Operations Bill of Materials (OBOM), Vulnerability Disclosure Reports (VDR), Vulnerability Exploitability eXchange (VEX), and CycloneDX Attestations (CDXA).
CycloneDX schemas are the official interpretations of the standard, with the JSON Schema serving as the reference implementation. The specification is versioned, with the latest release as of 2025 being CycloneDX 1.7, following a structured release history dating back to its initial prototype in May 2017.
How It Works
CycloneDX operates by defining structured formats for documenting components, dependencies, and metadata within a BOM. It supports three primary formats: XML, JSON, and Protocol Buffers (Protobuf), each registered with IANA under specific media types: application/vnd.cyclonedx+xml, application/vnd.cyclonedx+json, and application/x.vnd.cyclonedx+protobuf. Version-specific formats can be specified using parameters, such as application/vnd.cyclonedx+xml; version=1.6, ensuring backward and forward compatibility across implementations.
Files adhering to the CycloneDX standard conventionally use extensions like bom.json, bom.xml, .cdx.json, or .cdx.xml to denote their format. The specification also incorporates attestation mechanisms (CDXA), enabling verifiable claims about the integrity, provenance, and security posture of components. These attestations are critical for trust in supply chains, particularly in regulated industries like medical devices and defense.
The standard’s design emphasizes interoperability and extensibility. It aligns with existing frameworks like SPDX for license management and integrates with tools across over 260 implementations in 20+ programming languages.
Use Cases
CycloneDX addresses a wide array of use cases, particularly in sectors where supply chain security is paramount. In software development, it enables teams to generate SBOMs that catalog dependencies, licenses, and vulnerabilities, facilitating compliance with regulations like SBOM mandates from the U.S. For Software-as-a-Service (SaaS), the SaaSBOM variant provides visibility into cloud-based dependencies, helping organizations assess risks in third-party services.
In hardware and manufacturing, the HBOM and MBOM variants document components and materials, ensuring traceability in industries such as medical devices, where CycloneDX is authorized for use by manufacturers to demonstrate secure production processes.
For AI and machine learning, CycloneDX introduces the ML-BOM, which captures model cards, training data provenance, and performance tradeoffs.
Beyond development, CycloneDX supports operational and vulnerability management through VDR and VEX formats.
The Tool Center within the CycloneDX ecosystem serves as a marketplace for open-source and proprietary tools that generate, analyze, or consume CycloneDX BOMs. This includes solutions for static analysis, dependency scanning, and compliance reporting, ensuring that organizations can integrate CycloneDX into existing workflows without disrupting operations. Examples of supported tools range from dependency scanners like Dependabot to configuration management databases (CMDBs) used in enterprise IT and OT environments.
Key Features & Capabilities
- Comprehensive BOM Coverage: Supports SBOM, SaaSBOM, HBOM, ML-BOM, CBOM, MBOM, OBOM, VDR, and VEX, addressing risks across software, hardware, AI, and operational domains.
- Standardized Formats: Provides XML, JSON, and Protobuf schemas, with IANA-registered media types ensuring interoperability and tooling support.
- License and Compliance: Integrates with SPDX license IDs and expressions, supporting open-source compliance and Software Asset Management (SAM) use cases.
- Regulatory Alignment: Authorized for use in medical devices, defense systems, and critical infrastructure, meeting mandates from governments and industry standards bodies.
- Tool Ecosystem: Compatible with over 260 tools across 20+ languages, including CI/CD pipelines, vulnerability scanners, and configuration management systems.
- Versioned Releases: Structured release history from 2017 to 2025, with each version introducing incremental improvements and backward compatibility.
- Supply Chain Transparency: Facilitates end-to-end visibility from development to deployment, enabling proactive risk mitigation in IT and OT environments.