CISA 2026 SBOM checklist for medical devices
Every field in the CISA 2026 minimum elements, plus the support fields the FDA recommends, with what each source asks for. Tick what your SBOM already includes.
What changed
On July 29, 2026, CISA and partner agencies published new SBOM minimum elements. They replace the 2021 NTIA list as the general baseline with 17 data fields, 10 of them new, such as component hash, license, and SBOM tool. Coverage replaces the old depth practice.
What the FDA cites
The FDA's February 3, 2026 premarket guidance still cites the NTIA 2021 list. It also recommends each component's support level and end-of-support date.
How to use this
Build to CISA 2026, then add the FDA support fields. That covers both. Record anything unknown instead of leaving it blank.
0 of 20 items ticked. Nothing you tick is saved or sent.
Core fields (NTIA 2021, carried into CISA 2026)
The entity that creates, defines, and identifies each component. CISA renamed this from supplier name.
NTIA 2021: YesCISA 2026: RequiredFDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
The name the producer assigns to each software unit.
NTIA 2021: YesCISA 2026: RequiredFDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
The version identifier used to tell releases apart.
NTIA 2021: YesCISA 2026: RequiredFDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
Machine-readable unique identifiers, such as PURL or CPE, that help look up each component.
NTIA 2021: YesCISA 2026: RequiredFDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
How components relate, for example that one component includes another.
NTIA 2021: YesCISA 2026: RequiredFDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
The entity that created the SBOM data.
NTIA 2021: YesCISA 2026: RequiredFDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
The date and time the SBOM data was assembled.
NTIA 2021: YesCISA 2026: RequiredFDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
Data fields new in CISA 2026
The output of a cryptographic hash of each executable component artifact. Mark it unknown if you lack the artifact.
NTIA 2021: NoCISA 2026: Required (new)FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
The algorithm used to produce each component hash value.
NTIA 2021: NoCISA 2026: Required (new)FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
License identifiers for each component, for example SPDX license expressions.
NTIA 2021: NoCISA 2026: Required (new)FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
The tool that generated or amended the SBOM.
NTIA 2021: NoCISA 2026: Required (new)FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
The version of that tool.
NTIA 2021: NoCISA 2026: Required (new)FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
When in the lifecycle the SBOM was generated, such as before, during, or after build.
NTIA 2021: NoCISA 2026: Required (new)FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
The format recorded in the SBOM itself, for example SPDX or CycloneDX.
NTIA 2021: NoCISA 2026: Required (new)FDA: Related
The FDA recommends a machine-readable format but does not ask you to record its name.
The format version recorded in the SBOM, for example SPDX 2.3 or CycloneDX 1.6.
NTIA 2021: NoCISA 2026: Required (new)FDA: Related
The FDA sets no format version floor.
A version for the SBOM document, so readers know which revision they hold.
NTIA 2021: NoCISA 2026: Required (new)FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
A digital signature attributable to the SBOM author.
NTIA 2021: NoCISA 2026: Required (new)FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
CISA 2026 practice
List all components of the target software, including transitive dependencies. There is no minimum depth. This replaces the NTIA depth practice.
NTIA 2021: NoCISA 2026: PracticeFDA: Not cited
A CISA practice, not a data field. Not cited by the FDA guidance.
FDA additions for medical devices
Whether each component is actively maintained, no longer maintained, or abandoned, based on supplier evidence.
NTIA 2021: NoCISA 2026: Not listedFDA: FDA addition
Recommended by the FDA guidance alongside the SBOM. Missing information can be explained.
The date after which the supplier stops issuing security patches or support.
NTIA 2021: NoCISA 2026: Not listedFDA: FDA addition
Recommended by the FDA guidance alongside the SBOM. Unknown dates can be explained.
Sources and application
From SBOM fields to FDA submission evidence
An inventory needs supporting evidence. Reconcile the SBOM with the actual release, record generation methods, review supplier support information, and document unresolved gaps. CISA fields do not replace the manufacturer's cybersecurity risk assessment, security testing, or submission review.
Documented client case: AI-enabled cloud SaMD
Our published anonymized case describes an annual program with SBOM monitoring, SAST, coordinated vulnerability disclosure, and CISA KEV tracking. A penetration test across the web application, APIs, and AI endpoints also supplied evidence for a new 510(k) submission.
This is evidence of the agreed program activities. The case does not document use of this checklist or tool, CISA 2026 field scores, or a standalone SBOM-generation result. It is not proof of submission adequacy or a typical regulatory outcome.
510(k) AI SaMD Penetration Testing Case StudyIllustrative review: a missing supplier support date
Suppose an SBOM lists the component, version, producer, and dependencies, but the supplier has not provided an end-of-support date. Record the date as unknown, retain the supplier request, and identify the owner of the follow-up. Do not substitute a guessed date.
In the comparison tool, mark that field Missing or Partly until the underlying evidence supports Included. CISA data-field completeness and FDA support-field completeness remain separate. A high CISA score does not resolve the unknown support information.
Illustrative workflow only. Not a client engagement, uploaded SBOM assessment, or regulatory finding.
FDA SBOM Requirements for Medical DevicesPrimary sources and what each supports
- CISA: 2026 Minimum Elements for an SBOM, July 29, 2026
The general software transparency baseline. CISA states that it updates and replaces the NTIA 2021 minimum elements. It does not amend FDA guidance.
- The FDA: Cybersecurity in Medical Devices, February 3, 2026
Premarket cybersecurity recommendations, including the NTIA baseline and component support information. The ten added CISA data fields are not requirements of this guidance.
Official document identified in search results. Direct access was unavailable during our link check.
- NTIA: The Minimum Elements for an SBOM, July 2021
The seven baseline attributes referenced by the FDA's February 2026 guidance. Direct access may require passing the publisher's browser verification.
These documents support the field comparison. They do not endorse Blue Goat, this checklist, or the scoring tool. Scores measure self-reported field completeness, not verified component accuracy or FDA acceptance.
FDA submission evidence and SBOM generation
For applicability, support dates, and submission records, read FDA SBOM Requirements for Medical Devices. For generation and lifecycle methods, read SBOM for Medical Devices: The 2026 FDA Pillar Guide. A field checklist does not verify the component evidence behind an inventory.
Common questions
Does the FDA require the CISA 2026 minimum elements?
No. The FDA's February 3, 2026 premarket guidance was published before the CISA list and still cites the NTIA 2021 minimum elements. It also recommends component support level and end-of-support date. The CISA fields are a good practice, not an FDA expectation.
Did CISA replace the NTIA list?
Yes, as the general SBOM baseline. CISA and partner agencies published the 2026 minimum elements on July 29, 2026 to update and replace the 2021 NTIA list.
If we meet CISA 2026, are we covered for the FDA?
Mostly. The CISA list includes every NTIA field the FDA cites. Add support level and end-of-support date for each component, which the CISA list does not include.
Which formats work?
SPDX and CycloneDX are the two formats in use. The FDA recommends a machine-readable format and sets no version floor. CISA asks you to record the format name and version in the SBOM.
What if supplier information is missing?
Record it as unknown rather than guessing. CISA asks for known unknowns under coverage, and the FDA guidance lets you explain unavailable support information.
Need an SBOM built to both lists?
Blue Goat builds medical device SBOMs to the CISA 2026 minimum elements, plus the FDA support and end-of-support fields. Fixed fee after scoping.
See SBOM servicesSources: CISA and partner agencies, 2026 Minimum Elements for a Software Bill of Materials (July 29, 2026). FDA, Cybersecurity in Medical Devices: Premarket Submissions (Feb 3, 2026). NTIA, The Minimum Elements for a Software Bill of Materials (July 2021). This checklist summarizes these documents. It is not legal advice and does not predict FDA review outcomes.