CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS

The 2026 Minimum Elements guidance from CISA replaces the 2021 NTIA baseline, adds required hash, license and generation-context fields to every SBOM, renames Supplier Name to Component Producer, and extends the floor to open-source software, AI systems and software-as-a-service. For platform teams the practical consequence is that SBOM work stops living inside the build step and starts spilling into vendor contracts and runtime re-validation.

Raccontata dasecurityweek.comdarkreading.comdev.to