CISA vs FDA SBOM checklist tool
CISA 2026 minimum elements and FDA submission fields, scored separately for field completeness.
The FDA's guidance does not require the added CISA fields. Results are a planning aid, not a compliance finding. Nothing you enter is saved or sent. Full field details are on the CISA 2026 SBOM checklist.
FDA premarket (NTIA 2021 + support fields)
Not scoredField completeness: 0 of 9 included
Assessment incomplete: 0 of 9 fields answered
0 partly, 0 missing, 9 not answered
CISA 2026 (17 data fields)
Not scoredField completeness: 0 of 17 included
Assessment incomplete: 0 of 17 fields answered
0 partly, 0 missing, 18 not answered (including coverage)
Coverage practice: Not answered. Separate from the data-field score.
Each data field has equal weight. Only fully included fields earn credit. Partial, missing, and unanswered fields earn none. Scores reflect your answers, not an inspection of an SBOM file. A complete score does not establish submission adequacy or verify component data. Coverage and documented unknowns still need review.
Review applicability and supporting records in FDA SBOM Requirements for Medical Devices. For generation and maintenance, see SBOM for Medical Devices: The 2026 FDA Pillar Guide.
Component producer (NTIA: supplier name)
NTIA 2021: Yes · CISA 2026: Required · FDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
Component name
NTIA 2021: Yes · CISA 2026: Required · FDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
Component version
NTIA 2021: Yes · CISA 2026: Required · FDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
Component identifiers
NTIA 2021: Yes · CISA 2026: Required · FDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
Component dependency relationship
NTIA 2021: Yes · CISA 2026: Required · FDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
SBOM author
NTIA 2021: Yes · CISA 2026: Required · FDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
SBOM timestamp
NTIA 2021: Yes · CISA 2026: Required · FDA: Cited (NTIA)
Cited through the NTIA 2021 minimum elements.
Component hash value
NTIA 2021: No · CISA 2026: Required (new) · FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
Component hash algorithm
NTIA 2021: No · CISA 2026: Required (new) · FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
Component license
NTIA 2021: No · CISA 2026: Required (new) · FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
SBOM tool name
NTIA 2021: No · CISA 2026: Required (new) · FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
SBOM tool version
NTIA 2021: No · CISA 2026: Required (new) · FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
SBOM generation context
NTIA 2021: No · CISA 2026: Required (new) · FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
SBOM data format name
NTIA 2021: No · CISA 2026: Required (new) · FDA: Related
The FDA recommends a machine-readable format but does not ask you to record its name.
SBOM data format version
NTIA 2021: No · CISA 2026: Required (new) · FDA: Related
The FDA sets no format version floor.
SBOM version
NTIA 2021: No · CISA 2026: Required (new) · FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
SBOM author signature
NTIA 2021: No · CISA 2026: Required (new) · FDA: Not cited
Not cited by the FDA guidance. Recommended for the current general baseline.
Coverage, including transitive dependencies
NTIA 2021: No · CISA 2026: Practice · FDA: Not cited
A CISA practice, not a data field. Not cited by the FDA guidance.
Level of support per component
NTIA 2021: No · CISA 2026: Not listed · FDA: FDA addition
Recommended by the FDA guidance alongside the SBOM. Missing information can be explained.
End-of-support date per component
NTIA 2021: No · CISA 2026: Not listed · FDA: FDA addition
Recommended by the FDA guidance alongside the SBOM. Unknown dates can be explained.
Sources and application
From SBOM fields to FDA submission evidence
An inventory needs supporting evidence. Reconcile the SBOM with the actual release, record generation methods, review supplier support information, and document unresolved gaps. CISA fields do not replace the manufacturer's cybersecurity risk assessment, security testing, or submission review.
Documented client case: AI-enabled cloud SaMD
Our published anonymized case describes an annual program with SBOM monitoring, SAST, coordinated vulnerability disclosure, and CISA KEV tracking. A penetration test across the web application, APIs, and AI endpoints also supplied evidence for a new 510(k) submission.
This is evidence of the agreed program activities. The case does not document use of this checklist or tool, CISA 2026 field scores, or a standalone SBOM-generation result. It is not proof of submission adequacy or a typical regulatory outcome.
510(k) AI SaMD Penetration Testing Case StudyIllustrative review: a missing supplier support date
Suppose an SBOM lists the component, version, producer, and dependencies, but the supplier has not provided an end-of-support date. Record the date as unknown, retain the supplier request, and identify the owner of the follow-up. Do not substitute a guessed date.
In the comparison tool, mark that field Missing or Partly until the underlying evidence supports Included. CISA data-field completeness and FDA support-field completeness remain separate. A high CISA score does not resolve the unknown support information.
Illustrative workflow only. Not a client engagement, uploaded SBOM assessment, or regulatory finding.
FDA SBOM Requirements for Medical DevicesPrimary sources and what each supports
- CISA: 2026 Minimum Elements for an SBOM, July 29, 2026
The general software transparency baseline. CISA states that it updates and replaces the NTIA 2021 minimum elements. It does not amend FDA guidance.
- The FDA: Cybersecurity in Medical Devices, February 3, 2026
Premarket cybersecurity recommendations, including the NTIA baseline and component support information. The ten added CISA data fields are not requirements of this guidance.
Official document identified in search results. Direct access was unavailable during our link check.
- NTIA: The Minimum Elements for an SBOM, July 2021
The seven baseline attributes referenced by the FDA's February 2026 guidance. Direct access may require passing the publisher's browser verification.
These documents support the field comparison. They do not endorse Blue Goat, this checklist, or the scoring tool. Scores measure self-reported field completeness, not verified component accuracy or FDA acceptance.
Sources: FDA, Cybersecurity in Medical Devices: Premarket Submissions (Feb 3, 2026). CISA and partner agencies, 2026 Minimum Elements for a Software Bill of Materials (July 29, 2026). NTIA, The Minimum Elements for a Software Bill of Materials (July 2021).