SPDX vs CycloneDX SBOM formats
| Dimension | SPDX | CycloneDX |
|---|---|---|
| Steward | Linux Foundation (SPDX project). | OWASP Foundation (CycloneDX project). |
| ISO standard | ISO/IEC 5962:2021. | ECMA-424 (2024); under ISO/IEC review. |
| Primary use case | Software supply-chain compliance and license tracking. | Application-security and vulnerability management. |
| Native serializations | Tag-Value, JSON, YAML, RDF, XML, spreadsheet. | JSON, XML, Protocol Buffers. |
| FDA acceptance | Explicitly named in FDA premarket cybersecurity guidance. | Explicitly named in FDA premarket cybersecurity guidance. |
| Vulnerability data (VEX) | Supports CSAF VEX externally; SPDX 3.0 adds an in-document VEX profile. | Native VEX support since v1.4 (CycloneDX-VEX). |
| Cryptographic / ML-BOM | Profiles emerging in SPDX 3.x. | Mature CBOM and ML-BOM extensions. |
| Hardware (HBOM) | Limited; planned in 3.x. | Supported via HBOM extension. |
| Tooling | Strong in build-time license scanners (FOSSology, ORT, Tern). | Strong in CI security tools (Dependency-Track, Anchore, Snyk, Syft). |
Related
Ready when you are
Get FDA cleared without the cybersecurity headaches.
30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.