3-minute SBOM score

Is your SBOM program prepared for an FDA premarket submission?

Eleven questions combining Section 524B obligations and guidance recommendations with company supply-chain practices, including SLSA, Sigstore, and AI-origin tracking. Get a company checklist score and a prioritized gap list, not a prediction of regulatory acceptance.

Reviewed by

Christian Espinosa

Founder & CEO, Blue Goat Cyber

Last reviewed October 29, 2026

Question 1 of 110% complete

What SBOM format do you generate today?

What you'll see after you submit

Your answers become a 0-100 readiness score and category breakdown

RingScore infographic: overall SBOM readiness as a percentage with tone (green/amber/red).
Radial breakdown across format, depth, VEX, monitoring, and update cadence - see exactly which lever is dragging the score.
Gap-by-gap remediation list mapped to FDA's premarket and postmarket expectations.
Print/PDF view formatted for handing to a CTO or auditor.

Common misconceptions

What teams usually get wrong

Myth: A top-level dependency list is an SBOM.
Reality: FDA expects transitive depth. The SBOM must include components your components depend on, down to the smallest unit you can practically resolve (NTIA 'minimum elements').
Myth: SPDX and CycloneDX are interchangeable for FDA.
Reality: Both are accepted, but each has different VEX maturity, hashing conventions, and tooling support. Pick one, document why, and stay consistent across premarket and postmarket.
Myth: Once we ship the SBOM, we're done.
Reality: §524B requires a maintained SBOM with monitoring and updates for the supported lifetime of the device. A static PDF in your submission is a postmarket deficiency in waiting.
Myth: VEX is optional.
Reality: It's not statutorily required, but without VEX every new CVE in your SBOM looks like an open issue. Many teams use VEX to explain non-exploitable findings, though the FDA does not require it.