SBOM Validator (BSI TR-03183-2)

TR-03183-2 is the German Federal Office for Information Security (BSI) technical guideline on SBOMs for the Cyber Resilience Act. Version 2.1.0 requires a machine-processable SBOM in CycloneDX 1.6 or later, or SPDX 3.0.1 or later (JSON or XML), one SBOM per software version, and a defined set of data fields: the SBOM's creator and timestamp, and for every component its creator, name, version, filename, dependencies, distribution licences, a SHA-512 hash of the deployable form, and the executable, archive and structured properties.

Yes. CRA Annex I Part II(1) requires manufacturers to identify and document vulnerabilities and components, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product. TR-03183-2 is the most concrete official guidance available on how to fulfil this.

Older versions still parse and remain useful, and TR-03183-2 includes a transitional system. However, the current guideline sets CycloneDX 1.6 and SPDX 3.0.1 as the minimum for a newly generated or updated SBOM. Most SBOM generators can already emit CycloneDX 1.6, so upgrading is usually a one-flag change in your build pipeline.

No. Validation runs entirely in your browser using the same open logic that CRA Portal uses server-side. Your SBOM never leaves your machine when you use this page.

TR-03183-2 explicitly says an SBOM MUST NOT contain vulnerability information, because SBOM data is static per software version while vulnerability knowledge changes daily. Vulnerability communication belongs in separate documents such as CSAF security advisories or VEX. CRA Portal publishes CSAF 2.0 advisories for exactly this purpose.