CycloneDX

CycloneDX is an open-standard Software Bill of Materials (SBOM) format maintained by the OWASP (Open Web Application Security Project) Foundation. It represents the components that make up a software product - including libraries, frameworks, operating system packages, and firmware - along with their versions, package URLs (PURLs), cryptographic hashes, and licence information. CycloneDX supports JSON, XML, and Protocol Buffers serialisation and is designed for machine-readable processing by vulnerability management tools, software composition analysis platforms, and supply chain security systems. CycloneDX goes beyond a pure inventory format: it explicitly supports VEX (Vulnerability Exploitability eXchange) documents, service dependencies, hardware component inventories, and cryptographic bill of materials (CBOM) - making it particularly comprehensive for CRA technical documentation purposes.

The CRA's Annex VII requires manufacturers to include an SBOM in their technical documentation file. CycloneDX satisfies this requirement and provides capabilities that facilitate broader CRA compliance:

• Component inventory: Lists all software components with versions and PURLs, supporting SBOM-based CVE correlation.
• VEX integration: CycloneDX natively embeds VEX statements within the SBOM, allowing manufacturers to assert which CVEs do not affect the product - reducing alert noise for users.
• License compliance: Tracks component licences, supporting intellectual property management alongside security obligations.
• Hash verification: Cryptographic hashes for each component enable integrity verification, supporting the CRA's supply chain security requirements.
• Composition completeness: CycloneDX includes a 'completeness' field indicating how thoroughly the SBOM captures all components, helping MSAs assess the file's reliability as evidence.

CycloneDX and SPDX are both well-supported SBOM standards, and the choice follows the job the SBOM has to do rather than the regulation.

For CRA compliance, CycloneDX is generally preferred where the primary SBOM use case is vulnerability management, and SPDX where licence compliance is the primary driver. Both satisfy the Annex VII technical documentation requirement, and neither is named by the Regulation, which specifies a commonly used machine-readable format rather than a format. Many organisations generate both.

CycloneDX SBOMs can be generated using open-source and commercial tooling:

• Language-specific tools: The CycloneDX project maintains open-source plugins for Maven, Gradle, npm, Python pip, Go modules, .NET, and others - each capable of generating a CycloneDX SBOM for the respective language ecosystem's dependencies.
• Container scanning: Tools such as Syft (Anchore) generate CycloneDX SBOMs from container images, capturing all OS packages and language dependencies in the image layer.
• IDE integration: Many modern IDEs and CI/CD platforms integrate CycloneDX generation into build pipelines, enabling automatic SBOM generation on every release.
• Dependency-Track: OWASP Dependency-Track natively consumes CycloneDX SBOMs and provides continuous vulnerability monitoring, making it a natural companion to CycloneDX generation tooling.