IMDRF SBOM Workflow

Software Bill of Materials (NTIA/FDA/IMDRF/MDR)

Capture NTIA minimum elements (component, version, supplier, dependencies, licenses), optional vulnerabilities & hashes, and export in SPDX/CycloneDX/Markdown.

Step 1 — Project & Import

Project / Product name Appears in exported SBOM and audit trail.

Lifecycle stage

Repo or artifact URL (optional)

Import existing SBOM (SPDX/CycloneDX) Optional — you can edit/augment after import.

Step 2 — Components (NTIA minimum elements)

Add each software component. Include version, supplier, license, and dependency reference if applicable.

Component name

Version

Supplier / Vendor

License (SPDX ID)

Direct dependency of (component name)

Package URL (purl)

Vulnerability (CVE id, optional)

Hash (SHA-256, optional)

Notes

0 components

Step 3 — Export & Actions

Export format CycloneDX JSON is usually preferred by FDA.

Signing / attestation (optional)

Awaiting input…

Back to Index