Check an SBOM's quality
The Regulation asks for an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies (Annex I Part II(1)), and does not say which fields. BSI TR-03183-2 is the published answer European buyers point to, so every SBOM you upload is read against it.
The score is a measure of what the file carries. It is not binding and not a conformance verdict, and some of the guideline's fields (file names, the executable and archive properties) are not read.
What is checked
For the document: the format and version (CycloneDX 1.6 or later; SPDX 2.2 and 2.3 are read but fail this check, because the guideline asks for SPDX 3.0.1), who wrote it, when, and whether it records which component depends on which.
For every component: a version, a named supplier or author, a package URL, a SHA-512 hash and a licence. Component checks score the share of components that pass.
Steps
- Upload an SBOM as usual (see Upload an SBOM).
- On the product page, under the version, open the line reading NN/100 of the fields BSI TR-03183-2 asks for. Each check shows whether it passed, how many components passed, and what to change.
- Fix the generator settings and upload again. The score is recomputed for each upload.
To check a file without an account, use the free SBOM quality check. It parses the file in memory, returns the score, and stores nothing. The free KEV check shows the same score beside its result.