CISA has published version 2.1 of the Minimum Elements for a Software Bill of Materials. It replaces the 2021 NTIA document that has served as the default answer to what an SBOM has to contain.
Seventeen partner agencies signed it. Seven are EU national cybersecurity agencies, from France, Germany, Italy, Poland, Slovakia, the Netherlands and Czechia. DG CONNECT contributed. The text cites Regulation (EU) 2024/2847 by name and points to BSI TR-03183-2 as related guidance.
It is still not EU law, and the Commission says so. Because the document is a multilateral effort, not all of its elements reflect Union law, and by its own terms it creates no new requirements. What it changes is the answer a buyer will expect when they ask you for an SBOM.
What is in it
The old baseline listed seven data fields. This one lists seventeen, nine describing the SBOM document and eight describing each component, alongside six practices covering how the document is generated, maintained and delivered.
Where it cuts across the CRA
Annex I Part II(1) asks for an SBOM covering at the very least the top-level dependencies. The 2026 elements dropped the old Depth element and put Coverage in its place, which asks for the full component graph including transitive dependencies and states that there is no minimum depth.
Build to the CRA floor and you fail the new baseline. That is a structural mismatch rather than an oversight, and it lands hardest on the manufacturers who read Annex I literally and stopped at the top level. Seven EU agencies put their names to the document that says top-level-only is insufficient.
Two baselines that disagree
The gap runs the other way as well. BSI TR-03183-2 sets format version floors of CycloneDX 1.6 and SPDX 3.0.1. The 2026 elements set none, asking only that deprecated versions be avoided. So a CycloneDX 1.5 file passes CISA and fails BSI.
Our SBOM validator reports the two as separate panels for that reason, and marks the CISA result as international guidance. One blended score would bury the only part worth knowing, which is where the two frameworks disagree about your specific document.
What to do
Generate the full dependency graph instead of the top level. Keep the format version high enough for BSI. Mark unknowns explicitly, which SPDX handles through NOASSERTION and NONE and CycloneDX has no reserved marker for. Then read the two results apart from each other.
The publication is on the CISA site. Our field-by-field comparison covers the full delta, including which fields a parsed document genuinely cannot evidence.
Check an SBOM against the BSI baseline and the 2026 minimum elements side by side.
Open the SBOM validator