How to validate an SBOM: a step-by-step guide

A repeatable procedure for checking an SBOM you generated or received, from schema checks to comparing it with the artefact. Commands use well-known open-source tools; adapt them to your pipeline.

Before you start

Decide which baseline you are validating against, for example the CERT-In 21 fields, the CISA 2026 Minimum Elements or BSI TR-03183-2. For the concepts behind each step, see SBOM validation. The commands below are examples from each tool's documentation; check current options before use.

Step 1: Identify the document

Record the format, specification version, author, timestamp, tool and product version the SBOM claims to describe. The 2026 CISA elements expect the format name and version, tool name and version, and generation context to be present ^[1]. If any are missing, note it now.

Step 2: Validate against the schema

For CycloneDX, use CycloneDX CLI, which returns a non-zero exit code on errors when asked to ^[2]:

cyclonedx validate --input-file bom.json --fail-on-errors

For SPDX 2.2 or 2.3, SPDX tools-python parses and validates the document ^[3]:

pyspdxtools -i sbom.spdx.json

A schema failure means consumers' tools may reject or misread the document. Fix it before anything else.

Step 3: Check required fields

For SPDX documents, the NTIA Conformance Checker tests the NTIA minimum elements by default, or CISA's 2024 framing baseline ^[4]:

sbomcheck sbom.spdx.json --comply fsct3-min

For CycloneDX or SPDX, sbomqs runs compliance profiles such as BSI TR-03183-2 and FSCT, and can list components missing a feature such as a version or supplier ^[5]:

sbomqs compliance --bsi-v2 sbom.json

sbomqs list sbom.json --feature comp_supplier --missing

No open-source checker named here tests the CERT-In list as a built-in profile, so map CERT-In's fields to the document's properties and check them with a script or a policy engine. Distinguish declared unknowns from silent gaps, as NTIA asks ^[6].

Step 4: Score quality

Run a quality score to compare SBOMs and set thresholds ^[5]:

sbomqs score sbom.json

Use the score as a gate for supplier intake and track it per supplier over time. Avoid features that upload the SBOM to an external service if the document is confidential.

Step 5: Verify integrity

• If the SBOM is signed, verify the signature. CycloneDX CLI includes sign and verify commands ^[2].
• Compute the hash of the delivered artefact and compare it with the hash recorded in the SBOM.

CERT-In recommends digitally signing shared SBOMs so recipients can confirm authenticity and detect tampering ^[7].

Step 6: Check accuracy against the artefact

Generate an independent SBOM from the delivered image or files and compare. For example, with Syft ^[8]:

syft <image> -o cyclonedx-json=./analysed.cdx.json

Then diff the two with CycloneDX CLI ^[2]:

cyclonedx diff supplied.cdx.json analysed.cdx.json --component-versions

Components found by analysis but missing from the supplied SBOM are questions for the supplier. CISA notes that analysed SBOMs can verify SBOMs from other sources ^[9].

Step 7: Run a vulnerability check

Confirm the SBOM is usable by scanning it, for example with Trivy ^[10] or Grype ^[11]:

trivy sbom sbom.json

grype sbom:./sbom.json

If components produce no matches because identifiers are missing, the SBOM will not support vulnerability management.

Step 8: Record the result

Store the SBOM as received, the validation outputs, the date and the decision (accepted, accepted with gaps, rejected). Request corrections from the supplier with the specific failures listed. Re-run steps 3 and 7 periodically, because vulnerability, patch-status and EOL information in the SBOM goes stale after delivery.

To automate the procedure, run steps 2 to 4 as pipeline gates for your own software, and steps 2 to 7 at supplier intake before the SBOM enters your inventory.

How IntelliXBOM helps

IntelliXBOM automates these checks on generation and intake: it validates CycloneDX and SPDX SBOMs against required-field policies including CERT-In's, flags missing and stale fields, and keeps validation results with each SBOM version as timestamped evidence.