--- title: "The Complete Guide to CycloneDX | FOSSA Learning Center" description: "Learn about CycloneDX, the open source standard for software bill of materials (SBOM) designed for application security contexts and supply chain component analysis." canonical_url: "https://fossa.com/learn/cyclonedx/" markdown_url: "https://fossa.com/learn/cyclonedx.md" language: "en" author: "FOSSA" organization: "FOSSA" --- # The Complete Guide to CycloneDX | FOSSA Learning Center > Learn about CycloneDX, the open source standard for software bill of materials (SBOM) designed for application security contexts and supply chain component analysis. ## A Practical Guide to CycloneDX Get an overview of the CycloneDX bill of materials standard, including use cases, strategies for generating an SBOM, and comparisons to SPDX. #### Contents #### Related Resources - [##### Understanding SPDX Learn about the SPDX specification for license compliance and security](https://fossa.com/learn/spdx.md) - [##### Complete Guide to SBOMs A comprehensive overview of SBOMs: their data fields, use cases, formats, and more](https://fossa.com/learn/sboms.md) - [##### Software Supply Chain Security Discover how SBOMs fit into your supply chain security strategy](https://fossa.com/learn/software-supply-chain-security.md) ### Introduction to CycloneDX CycloneDX is a full-stack bill of materials specification designed for modern software supply chains. It's best known as a software bill of materials (SBOM) standard — and [SBOMs](https://fossa.com/learn/sboms.md) are a top use case — but CycloneDX can also be used for vulnerability reports and many other bill of materials varieties. CycloneDX has gained significant popularity and increased adoption since it was listed as an approved SBOM data format in the [U.S. federal government's 2021 cybersecurity executive order](https://fossa.com/blog/cybersecurity-executive-order-software-supply-chain-security.md). But the standard has been in existence for several years, dating back to 2017 when the initial prototype was released. The current [CycloneDX v1.7](https://fossa.com/blog/whats-new-cyclone-dx-1-7.md) was published in October, 2025. This followed the release of [CycloneDX 1.6](https://fossa.com/blog/whats-new-cyclonedx-1-6.md) in April, 2024, and [CycloneDX 1.5](https://fossa.com/blog/whats-new-cyclonedx-1-5.md) in June, 2023. ##### What is CycloneDX used for? While primarily used for SBOMs, CycloneDX supports multiple use cases including vulnerability management (VEX), operations bill of materials (OBOM), machine learning bill of materials (ML-BOM), and hardware bill of materials. #### CycloneDX Evolution Timeline 2017 ##### CycloneDX Created OWASP Foundation established CycloneDX as a security-focused SBOM standard. 2021 ##### Executive Order 14028 CycloneDX was approved as an SBOM standard in President Biden's cybersecurity order. 2023 ##### CycloneDX 1.5 Released Added support for ML-BOM, MBOM, and SBOM for Low Code Application Platforms. 2024 ##### CycloneDX 1.6 Released Added support for Cryptographic Bill of Materials (CBOM) and other enhancements. 2025 ##### CycloneDX 1.7 Released Added patent-related fields, structured citations for provenance, and expanded cryptography support. [Try FOSSA's SBOM Tool](https://fossa.com/request-sbom-demo) ### CycloneDX Use Cases Although CycloneDX is often thought of exclusively as a software bill of materials format, it can be used for other important supply chain security initiatives. These include OBOM (operations bill of materials), BOV (bill of vulnerabilities), VDR (vulnerability disclosure report), and [VEX (vulnerability exploitability exchange)](https://fossa.com/blog/vulnerability-exploitability-exchange-vex-purpose-use-cases.md), among others. CycloneDX 1.5 added three new use cases to support supply chain security and transparency in even more industries: Machine Learning Bill of Materials (ML-BOM), Manufacturing Bill of Materials (MBOM), and SBOM for Low Code Application Platforms, while CycloneDX 1.6 added support for Cryptographic Bill of Materials (CBOM). ##### CycloneDX can represent services too CycloneDX can describe endpoint URIs, trust boundary traversals, authentication requirements, data classifications, directional flow of data, and providers for SaaS and other services your software relies on. ##### Primary CycloneDX Use Cases - **Component inventory:** This serves as the foundation for all component analysis. CycloneDX can describe multiple types of components: applications, containers, devices, libraries, files, firmware, frameworks, operating systems, and services. - **Vulnerability analysis:** CycloneDX can be used for several different types of vulnerability analysis: known vulnerabilities, unknown vulnerabilities, vulnerability exploitability, and whether a vulnerability has been remediated. - **Software package evaluation:** CycloneDX enables several dimensions of package analysis, including age and overall health of open source packages. - **License identification and compliance:** CycloneDX offers multiple ways to document open source licenses: SPDX license IDs, SPDX expressions, and license names. Additionally, CycloneDX v1.5 added support for commercial licenses. - **Assemblies:** With CycloneDX, you can represent complex component assemblies and digitally sign each one, similar to how physical subcomponents are tracked in manufacturing. - **Component pedigree:** CycloneDX captures software component pedigree: the relationships in terms of descendants, variants, ancestors, and specific modifications made to open source components. [Read More: The Authoritative Guide to SBOM](https://cyclonedx.org/guides/sbom/OWASP_CycloneDX-SBOM-Guide-en.pdf) ### Elements of a CycloneDX Bill of Materials The CycloneDX bill of materials model consists of 11 root-level elements that provide a comprehensive framework for describing software components and their relationships. ##### Root-Level Elements Explained - **Metadata:** Information about the component, supplier, and manufacturer that the bill of materials describes, including license information and tools used to generate it. - **Components:** Individual first- and third-party components that make up the larger component your BOM describes, including applications, libraries, frameworks, and more. - **Services:** External APIs that your software may call, including endpoint URIs, trust boundary traversals, and authentication requirements. - **Dependencies:** Relationships capturing what components rely on other components or what services depend on other services, including both direct and transitive dependencies. - **Compositions:** Used to capture the degree to which your description of BOM elements is complete or incomplete, distinguishing between various levels of completeness. - **Vulnerabilities:** Details about known and previously unknown vulnerabilities, including severity scores, VEX data, and remediation status. - **Formulation:** Added in CycloneDX 1.5, describes how something was manufactured or deployed, including tasks, steps, and workflows. - **Annotations:** Added in CycloneDX 1.5, allows for additional context such as comments or notes to be added to the bill of materials. - **Declarations:** Added in CycloneDX 1.6, used to describe compliance with regulatory requirements and state claims about security processes. - **Definitions:** Added in CycloneDX 1.6, provides a mechanism to define standards, best practices, and maturity models. - **Citations:** Added in CycloneDX 1.7, allows SBOM authors to declare where specific BOM data originated — such as a build system, an SBOM generation tool, an artifact repository, or manual input — enabling verifiable chains of provenance. ##### CycloneDX is extensible CycloneDX includes multiple extension points to enable fast prototyping of new capabilities and support for specialized and future use cases, making it adaptable to evolving needs. ### CycloneDX vs. SPDX CycloneDX and [SPDX](https://fossa.com/learn/spdx.md) occupy a special place in the modern software bill of materials landscape. They're both human- and machine-readable, and they're the two approved full-stack SBOM formats under the U.S. government's 2021 cybersecurity executive order. #### SBOM Format Comparison CycloneDX is an OWASP Foundation standard designed specifically for application security and supply chain component analysis. While it supports license information, CycloneDX was created with a primary focus on security use cases. ##### Key Features - Support for JSON, XML, and Protocol Buffers - Built-in vulnerability reporting - Services and dependency graph capabilities - NTIA-compliant metadata fields - Strong VEX integration - Managed by OWASP Foundation ##### Pros - Security-focused from the start - Strong support for vulnerability data - Simpler structure than SPDX - Growing ecosystem adoption - Strong integration with DevSecOps tools ##### Cons - Newer standard (since 2017) - Licensing features added later - Fewer historical implementations ##### Key Differences ###### Origin Stories SPDX was originally developed primarily for open source license compliance and intellectual property use cases, while CycloneDX was created with security in mind. Both standards have evolved significantly since their initial releases, but their origins are still evident in their designs and capabilities. "As an OWASP project, we came from a security context, which is a little bit different than some of the other formats and their origin stories," CycloneDX Core Working Group Chair Steve Springett told FOSSA in a recent webinar. "Our origin story was really about security, and we bring that expertise to the format." ###### File Formats Both SPDX and CycloneDX are available in JSON and XML. SPDX also supports tag/value (which it describes as a "simple text-based format"), YAML, and Excel spreadsheets, while CycloneDX also supports Protocol Buffers. [Read More: SBOM Formats Compared](https://fossa.com/blog/sbom-formats-compared-explained.md) ### Generating a CycloneDX SBOM There are multiple ways to generate a CycloneDX software bill of materials, but as a general rule, we recommend doing so during the build process. This is because running an SBOM report right after the completion of your build will produce the most accurate inventory of dependencies possible. ##### Best practice for SBOM generation For maximum accuracy, [generate your SBOMs](https://fossa.com/blog/4-ways-generate-sbom.md) during the build process when all dependencies are present and accounted for in their exact versions. This creates a precise snapshot of your software at build time. With FOSSA, you can easily generate a CycloneDX SBOM in either JSON or XML formats. Here's how it works: ##### For New FOSSA Users 1. Start by [creating your free FOSSA account](https://app.fossa.com/auth/register). 2. Then, navigate to Projects > Add Project to import your first project. (You can integrate locally with our CLI or import code from a VCS like GitHub.) ##### Generate Your CycloneDX SBOM 1. Log into your account, and click on the "Projects" button in the header menu 2. Click on the Project that you'd like your SBOM to describe 3. Select the "Generate a Compliance Report" button from the "Actions" menu (on the right side of your screen) 4. Select your SBOM export format (FOSSA supports SPDX, Plain Text, CSV, Markdown, PDF, and HTML in addition to CycloneDX) 5. Decide which elements to include in your report — you can do this by checking (or unchecking) boxes in the "Customize Report Information" menu 6. Click on "Edit Dependency Info" in the "Customize Report Information" menu to decide which dependency metadata (e.g. author, package manager, file path, etc) to include in your SBOM 7. Generate your report — either download a copy to distribute yourself, or create a public link for your file FOSSA also supports the import of third-party CycloneDX SBOMs. You can use this feature to understand the composition of third-party software, including any security or license compliance risks it might pose. #### Frequently Asked Questions #### Ready to take the next step? Learn more about how FOSSA can help your organization [Learn About FOSSA](https://fossa.com/solutions/sbom-management.md) ## Frequently asked questions ### What is CycloneDX? CycloneDX is a full-stack bill of materials specification designed for modern software supply chains. It's primarily used as a software bill of materials (SBOM) standard, but can also be used for vulnerability reports, VEX data, and many other bill of materials varieties. ### What formats does CycloneDX support? CycloneDX supports several data formats, including JSON, XML, and Protocol Buffers. This allows for flexibility in how SBOMs are created, shared, and consumed across different systems and tools. ### How does CycloneDX differ from SPDX? While both are full-stack SBOM formats approved under the U.S. government's cybersecurity executive order, they have different origins and strengths. CycloneDX was created with security as its primary focus and has more extensive support for vulnerability management. SPDX started with license compliance as its focus and has more robust licensing capabilities. ### What are the main elements of a CycloneDX SBOM? A CycloneDX SBOM consists of 10 root-level elements: metadata, components, services, dependencies, compositions, vulnerabilities, formulation, annotations, declarations, and definitions. These elements allow for comprehensive documentation of software components and their relationships. ### Can CycloneDX represent hardware components? Yes, CycloneDX can be used to generate a hardware bill of materials. For IoT scenarios, this can describe the hardware stack and the software stack running on that hardware independently of one another. ## Source Canonical page: https://fossa.com/learn/cyclonedx/