SPDX (Software Package Data Exchange)

SPDX (Software Package Data Exchange) is an open standard for communicating software bill of materials information — the components that make up a software product, their versions, licensing terms, and relationships. Developed by the Linux Foundation, SPDX was standardised as ISO/IEC 5962:2021, making it the only SBOM format with formal international standard status. SPDX supports multiple serialisation formats: tag:value (human-readable), JSON, YAML, XML, and RDF. Each SPDX document identifies packages, files, and snippets with their associated licences, copyright notices, and relationships (e.g., 'contains', 'depends on', 'generated from'). SPDX is widely used in open source supply chain compliance and is gaining traction in regulated industry contexts including automotive (SBOM for automotive components) and healthcare.

SPDX satisfies the CRA's Annex VII SBOM requirement. Its ISO standardisation status provides additional regulatory credibility when submitted to Notified Bodies or market surveillance authorities. Key CRA-relevant capabilities:

• Component inventory: SPDX documents all packages in a product with version information, supporting SBOM-based CVE correlation.
• Licence compliance: SPDX's detailed licence expression syntax (using SPDX licence identifiers) enables manufacturers to document their intellectual property obligations alongside security posture.
• Relationship tracking: SPDX explicitly models relationships between components — 'package A depends on package B' — supporting dependency analysis for vulnerability impact assessment.
• SBOM provenance: SPDX documents the tool that generated the SBOM and the entity responsible for it, providing an audit trail relevant to Annex VII requirements.
• NTIA minimum elements: SPDX fully satisfies the US NTIA SBOM minimum elements, demonstrating alignment with international SBOM requirements.

SPDX 3.0, released in 2024, significantly improved support for security use cases that are directly relevant to CRA compliance:

• Security profile: A dedicated security profile adds support for CVE information, VEX status, CVSS scores, and exploitation data within the SPDX document — capabilities previously the domain of CycloneDX.
• AI/ML profile: Coverage of AI and machine learning model components, relevant for products incorporating AI elements.
• Modular structure: SPDX 3.0 uses a modular profile architecture, allowing documents to include only the profiles relevant to their use case, reducing verbosity.
• Improved PURL support: Better integration with Package URL (PURL) identifiers enabling more precise component identification for vulnerability correlation.

Manufacturers evaluating SPDX should target SPDX 3.0 for new implementations, as it offers security capabilities comparable to CycloneDX.

The US NTIA (National Telecommunications and Information Administration) published a set of minimum elements for SBOMs that has been widely adopted as a baseline internationally. These include: supplier name, component name, version, other unique identifiers (e.g., PURL or CPE), dependency relationships, author of the SBOM data, and timestamp. SPDX fully satisfies all NTIA minimum elements. For CRA Annex VII purposes, manufacturers should ensure their SPDX documents include at minimum: all NTIA minimum elements for each component; cryptographic hashes for integrity verification; licence information per component; and generation metadata (tool, date, author). Documenting NTIA minimum element compliance in the technical file demonstrates alignment with international SBOM norms, which strengthens the CRA compliance case.