A non-conformant SBOM deficiency almost always traces back to one of three problems: the SBOM is shallow (top-level dependencies only), the SBOM is missing required minimum elements (supplier, version, hash, unique identifier, relationship, author, timestamp), or the SBOM was generated in a way that the FDA reviewer cannot machine-parse against the rest of the cybersecurity package. The 2026 guidance and Section 524B made the SBOM a gating artifact - if it does not pass automated screening, the rest of your evidence may not be read.
Paraphrased patterns from real deficiency letters. Not verbatim FDA quotes.
The provided Software Bill of Materials does not include all NTIA minimum elements. Specifically, supplier name and unique identifier are missing for several components. Provide an updated SBOM that contains the minimum elements for every component.
The submitted SBOM appears to enumerate top-level dependencies only. Provide an SBOM that includes transitive (sub-)dependencies and identifies the relationship between components.
Provide the SBOM in a machine-readable format (SPDX or CycloneDX) consistent with the format referenced in the cybersecurity management plan, and ensure the version reported in the SBOM matches the device version under review.
Reviewers run automated tooling against submitted SBOMs before they read your narrative. A component that is technically present but missing a unique identifier (PURL or CPE) cannot be matched against vulnerability databases by their tools, and the reviewer treats it as 'not in the SBOM.' This is the most common reason teams that 'have an SBOM' still get a non-conformance. The fix is not adding more components; it is adding the identifier and version data that lets the SBOM round-trip through a tool.
An SBOM deficiency rarely arrives alone. If the SBOM lists a component the vulnerability management plan does not address, you will also receive a vulnerability management deficiency. If the SBOM version does not match the device version under review, you will receive a configuration management deficiency. If the SBOM contains a known-vulnerable component with no risk treatment in the CVE/CWE mapping, you will receive a third deficiency on that as well. Treat the SBOM as the spine of the cybersecurity package and verify every other artifact references the same component inventory before you file.
Already responding to this deficiency?
Our deficiency response engagement rebuilds the underlying artifact and produces a reviewer-ready response narrative.
FDA Cybersecurity Deficiency Response serviceBring us the letter. We will map a clean response and rebuild the underlying artifact to FDA 2026 expectations.
