--- title: "SBOM Quality & VEX Readiness Checklist - MedTech Cyber Tips" description: "What every cybersecurity reviewer (FDA or hospital) looks for in an SBOM: format, depth, signatures, hashes, supplier identification, and paired VEX statements." lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://medtechcybertips.com/#website", "url": "https://medtechcybertips.com/", "name": "MedTech Cyber Tips", "description": "The ultimate organized guide to medical device cybersecurity.", "inLanguage": "en-US", "publisher": { "@id": "https://medtechcybertips.com/#org" }, "potentialAction": { "@type": "SearchAction", "target": "https://medtechcybertips.com/topics?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "Organization", "@id": "https://medtechcybertips.com/#org", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/", "logo": "https://medtechcybertips.com/icon-512.png", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com", "sameAs": [ "https://home.bluegoatcyber.com/", "https://codebluechart.com/", "https://why.bluegoatcyber.com/", "https://spdf.bluegoatcyber.com/", "https://threatmodel.bluegoatcyber.com/", "https://pentesting.bluegoatcyber.com/", "https://premarket.bluegoatcyber.com/", "https://fdaresponse.bluegoatcyber.com/", "https://postmarket.bluegoatcyber.com/", "https://goatwatch.bluegoatcyber.com/" ] } } ] }, { "@context": "https://schema.org", "@type": "HowTo", "name": "SBOM Quality & VEX Readiness Checklist", "description": "What every cybersecurity reviewer (FDA or hospital) looks for in an SBOM: format, depth, signatures, hashes, supplier identification, and paired VEX statements.", "url": "https://medtechcybertips.com/resources/sbom-quality-checklist", "step": [ { "@type": "HowToSection", "position": 1, "name": "1. Format & Machine Readability", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "CycloneDX 1.4+ or SPDX 2.3+ provided" }, { "@type": "HowToStep", "position": 2, "name": "Valid against the official schema" }, { "@type": "HowToStep", "position": 3, "name": "Both human-readable and machine-readable copies available" }, { "@type": "HowToStep", "position": 4, "name": "Filename and version match the released firmware build" } ] }, { "@type": "HowToSection", "position": 2, "name": "2. Component Depth", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "Transitive dependencies enumerated" }, { "@type": "HowToStep", "position": 2, "name": "OS / kernel components included for embedded devices" }, { "@type": "HowToStep", "position": 3, "name": "Bootloader, container base images, and shared libraries listed" }, { "@type": "HowToStep", "position": 4, "name": "Build-time vs runtime dependencies distinguished" } ] }, { "@type": "HowToSection", "position": 3, "name": "3. Identity & Provenance", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "PURL (package URL) or CPE present for every component" }, { "@type": "HowToStep", "position": 2, "name": "Supplier / origin recorded" }, { "@type": "HowToStep", "position": 3, "name": "License declared" }, { "@type": "HowToStep", "position": 4, "name": "Cryptographic hash (SHA-256) for binary artifacts" }, { "@type": "HowToStep", "position": 5, "name": "Digital signature on the SBOM file itself" } ] }, { "@type": "HowToSection", "position": 4, "name": "4. Vulnerability & VEX Pairing", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "VEX document published in the same release" }, { "@type": "HowToStep", "position": 2, "name": "Status per CVE: not_affected, affected, fixed, under_investigation" }, { "@type": "HowToStep", "position": 3, "name": "Justification provided for not_affected statuses" }, { "@type": "HowToStep", "position": 4, "name": "VEX refreshed on a defined cadence" }, { "@type": "HowToStep", "position": 5, "name": "Process to publish updates when new CVEs land" } ] }, { "@type": "HowToSection", "position": 5, "name": "5. Lifecycle & Distribution", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "SBOM updated for every released build" }, { "@type": "HowToStep", "position": 2, "name": "Customer-accessible portal or contact for retrieval" }, { "@type": "HowToStep", "position": 3, "name": "Retention policy for historical SBOMs defined" }, { "@type": "HowToStep", "position": 4, "name": "End-of-support components flagged" }, { "@type": "HowToStep", "position": 5, "name": "Process documented in the QMS" } ] } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechcybertips.com" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://medtechcybertips.com/resources" }, { "@type": "ListItem", "position": 3, "name": "SBOM Quality & VEX Readiness Checklist", "item": "https://medtechcybertips.com/resources/sbom-quality-checklist" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What makes an SBOM 'high quality' for medical devices?", "acceptedAnswer": { "@type": "Answer", "text": "A high-quality SBOM is machine-readable (CycloneDX or SPDX), schema-valid, lists transitive dependencies and embedded OS components, identifies every component with a PURL or CPE, includes supplier and license, attaches cryptographic hashes for binary artifacts, and is digitally signed." } }, { "@type": "Question", "name": "What is VEX and why does it pair with the SBOM?", "acceptedAnswer": { "@type": "Answer", "text": "VEX (Vulnerability Exploitability eXchange) is a companion document that states, per CVE, whether your product is affected, not affected, fixed, or under investigation, with justifications. Without VEX, customers and regulators must assume every CVE in your SBOM applies, which generates noise and false escalations." } }, { "@type": "Question", "name": "How often should an SBOM be updated?", "acceptedAnswer": { "@type": "Answer", "text": "An SBOM should be regenerated for every released build of the firmware or software. VEX should be refreshed on a defined cadence and immediately when a new CVE materially changes the exploitability of a component." } }, { "@type": "Question", "name": "Do hospitals actually use SBOMs?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, increasingly. Health Delivery Organizations (HDOs) use SBOMs to assess procurement risk, drive MDS2 conversations, and accelerate response when industry-wide vulnerabilities (such as Log4Shell) emerge. Devices with retrievable, high-quality SBOMs clear procurement faster." } }, { "@type": "Question", "name": "CycloneDX or SPDX - which should we pick?", "acceptedAnswer": { "@type": "Answer", "text": "Both are accepted by FDA. CycloneDX has richer native support for VEX, ML-BOM, and vulnerability disclosure metadata, which makes it the pragmatic choice for medical devices. SPDX is stronger for license compliance. Many teams generate SPDX for licensing and CycloneDX for security." } }, { "@type": "Question", "name": "What are the most common SBOM defects reviewers cite?", "acceptedAnswer": { "@type": "Answer", "text": "Missing transitive dependencies, no PURL/CPE identifiers, no hashes on binary components, embedded OS components omitted entirely, no VEX paired with the SBOM, and SBOMs delivered as PDFs instead of machine-readable files." } } ] } ] --- [Skip to main content](#main) [ MedTech Cyber Tips The Ultimate Guide ](/) [Home](/)[Find Your Path](/journey)[All Topics](/topics)Reference[About](/about) Search ⌘K [All resources](/resources) SBOM · 5 min · 23 items # SBOM Quality & VEX Readiness Checklist An SBOM is only as valuable as it is complete, identifiable, and paired with VEX. Run this checklist before every release - not just at submission. Progress 0 / 23 (0%) Reset Print ## 1\. Format & Machine Readability Reviewers and hospital tools must be able to ingest the [SBOM](/glossary/sbom) automatically. - CycloneDX 1.4+ or SPDX 2.3+ provided - Valid against the official schema - Both human-readable and machine-readable copies available - Filename and version match the released firmware build ## 2\. Component Depth An SBOM that stops at top-level packages is not enough. - Transitive dependencies enumerated - OS / kernel components included for embedded devices - Bootloader, container base images, and shared libraries listed - Build-time vs runtime dependencies distinguished ## 3\. Identity & Provenance Each component must be uniquely identifiable. - PURL (package URL) or CPE present for every component - Supplier / origin recorded - License declared - Cryptographic hash (SHA-256) for binary artifacts - Digital signature on the SBOM file itself ## 4\. Vulnerability & VEX Pairing Pair the SBOM with [VEX](/glossary/vex) so the world knows which CVEs actually apply. - VEX document published in the same release - Status per CVE: not\_affected, affected, fixed, under\_investigation - Justification provided for not\_affected statuses - VEX refreshed on a defined cadence - Process to publish updates when new CVEs land ## 5\. Lifecycle & Distribution An SBOM is a living artifact, not a one-time deliverable. - SBOM updated for every released build - Customer-accessible portal or contact for retrieval - Retention policy for historical SBOMs defined - End-of-support components flagged - Process documented in the QMS ## Frequently asked questions Quick answers to the questions teams most often ask about this topic. ### What makes an SBOM 'high quality' for medical devices? A high-quality SBOM is machine-readable (CycloneDX or SPDX), schema-valid, lists transitive dependencies and embedded OS components, identifies every component with a PURL or CPE, includes supplier and license, attaches cryptographic hashes for binary artifacts, and is digitally signed. ### What is VEX and why does it pair with the SBOM? VEX (Vulnerability Exploitability eXchange) is a companion document that states, per CVE, whether your product is affected, not affected, fixed, or under investigation, with justifications. Without VEX, customers and regulators must assume every CVE in your SBOM applies, which generates noise and false escalations. ### How often should an SBOM be updated? An SBOM should be regenerated for every released build of the firmware or software. VEX should be refreshed on a defined cadence and immediately when a new CVE materially changes the exploitability of a component. ### Do hospitals actually use SBOMs? Yes, increasingly. Health Delivery Organizations (HDOs) use SBOMs to assess procurement risk, drive MDS2 conversations, and accelerate response when industry-wide vulnerabilities (such as Log4Shell) emerge. Devices with retrievable, high-quality SBOMs clear procurement faster. ### CycloneDX or SPDX - which should we pick? Both are accepted by FDA. CycloneDX has richer native support for VEX, ML-BOM, and vulnerability disclosure metadata, which makes it the pragmatic choice for medical devices. SPDX is stronger for license compliance. Many teams generate SPDX for licensing and CycloneDX for security. ### What are the most common SBOM defects reviewers cite? Missing transitive dependencies, no PURL/CPE identifiers, no hashes on binary components, embedded OS components omitted entirely, no VEX paired with the SBOM, and SBOMs delivered as PDFs instead of machine-readable files. Sponsored | how Blue Goat Cyber℠ helps ### Submit a package the FDA will accept Blue Goat Cyber℠ builds the cybersecurity sections of 510(k), De Novo, and PMA submissions, SBOM, threat model, testing, and the cybersecurity management plan. [Get help with your premarket submission](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) 4.9 / 5 · 15+ client reviews "Blue Goat provided testing on our system for cybersecurity and the necessary documentation to add to our regulatory submission. They were very knowledgeable in the requirements, communication was excellent, and they were able to expedite the testing and provide final reports in a very short period of time." Bernie Lane · Medical device manufacturer 250+ FDA submissions · 0 rejections Veteran-owned, Scottsdale AZ Exclusively medical device cybersecurity [ Previous FDA Premarket Cybersecurity Submission Checklist ](/resources/premarket-cyber-submission-checklist)[ Next Postmarket Vulnerability Response Template ](/resources/postmarket-vulnerability-response-template) MedTech Cyber Tips The organized, end-to-end guide to medical device cybersecurity, from concept through postmarket. Part of the Blue Goat Cyber family. Topics - [Overview](/topics/home) - [Why It Matters](/topics/why) - [SPDF](/topics/spdf) - [Threat Modeling](/topics/threatmodel) - [Pentesting](/topics/pentesting) Reference - [Glossary](/glossary) - [FDA vs MDR](/compare) - [Resources](/resources) - [Updates](/updates) - [RSS feed](/rss.xml) © 2026 medtechcybertips.com. An educational resource sponsored by Blue Goat Cyber. Not legal or regulatory advice.