As others have already commented: The US government has added SBOMs to a proposed rule to update the Federal Acquisition Regulation. So if you want to sell to

As others have already commented: The US government has added SBOMs to a proposed rule to update the Federal Acquisition Regulation. So if you want to sell to the US Government you'll have to provide SBOMs: https://www.federalregister.gov/documents/2023/10/03/2023-21328/federal-acquisition-regulation-cyber-threat-and-incident-reporting-and-information-sharing https://www.federalregister.gov/documents/2023/10/03/2023-21... Lots of large companies require SBOMs from their supplier. In the EU we will get the Cyber Resilience Act which will make them mandatory as well in certain cases: https://data.consilium.europa.eu/doc/document/ST-12536-2023-INIT/en/pdf https://data.consilium.europa.eu/doc/document/ST-12536-2023-... And yes, there's bascially two technical standards to provide them: SPDX and CycloneDX: https://cyclonedx.org/ https://cyclonedx.org/