Five years after NTIA set the original floor, CISA has published the 2026 Minimum Elements for a Software Bill of Materials, replacing that baseline with a version that requires component hashes, adds license and generation-context fields, and applies the same minimum to open-source software, AI systems and software-as-a-service. Per the reporting on DevOps.com, the document was drafted with the NSA, the FBI and international partners, and folded in more than ninety public comments plus a 2025 draft that was circulated for the same purpose. For CI/CD teams the operational consequence is simple. What used to be a build-time deliverable is now also a supplier problem and a runtime problem.
The fields that actually changed
The 2026 baseline adds a required component hash algorithm and hash value, plus component license, SBOM tool name, and SBOM generation context. It renames the old "Supplier Name" element to "Component Producer" so the same role reads the same way across the elements. The DevOps.com writeup, quoting an industry summary of the release, lists these as the concrete deltas against the 2021 minimum.
The hash requirement is the one that matters at build time. A component identifier does not tell you what you shipped. A package@version string tells your scanner what a library claims to be; it says nothing about the bytes that landed. If an upstream tarball is quietly replaced under the same version, an identifier-only check will still pass and every downstream SCA tool will nod along. Requiring a hash algorithm and value inside the SBOM gives you something to compare against what the build cache actually pulled, and what a signing service actually attested. Without a hash, a diff between "documented" and "deployed" is not computable in the first place.
