Free check
Is your SBOM good enough to hand over?
Drop in an SBOM. We read it the way a customer’s procurement team will, against the fields BSI TR-03183-2 asks for, and tell you what is missing.
The Regulation asks for an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies.Annex I Part II(1) It does not say which fields. Until harmonised standards do, TR-03183-2 is the published answer buyers point to.
Drop an SBOM, or choose a file
- Format
- CycloneDX SPDX
- Encoding
- JSON · XML JSON · tag-value
- Size
- up to 4 MB
Nothing is storedParsed in memory and discarded. No account, and no record of what you ship — we keep the count of how many components came back, never their names.
I do not have an SBOM
A software bill of materials is the list of every open-source component inside something you ship, with its version, written in a format other tools can read. Syft is a free tool from Anchore that builds one for you by reading a container image, a source directory or a binary. It takes a minute, and you only need it once per release.
# 1. Install it, on macOS brew install syft # ...or anywhere else curl -sSfL https://get.anchore.io/syft | sh -s -- -b /usr/local/bin # 2. Point it at what you ship syft acme/agent:latest -o cyclonedx-json > sbom.json # ...or at a source directory syft dir:. -o cyclonedx-json > sbom.json
Replace acme/agent:latest with your own image. The redirect writes the bill of materials to sbom.json, and syft keeps its progress on stderr, so the file stays valid JSON. Then drop that file above. The full guide covers formats and running it per release.
What it checks
For the document: the format and version (CycloneDX 1.6 or later, or SPDX 3.0.1 or later), who wrote it, when, and whether it records which component depends on which. For every component: a version, a named supplier, a package URL, a SHA-512 hash and a licence. Component checks are scored as the share of components that pass, so one missing licence in four hundred costs little and a generator that never writes hashes costs a lot.
What it does not tell you
Whether you comply. The guideline is German, not binding, and checked here at version 2.1.0; some of its fields, such as the file name and the executable and archive properties, are not read. SPDX 2.2 and 2.3 are read but fail the version check, because the guideline asks for SPDX 3. And a complete SBOM says nothing about whether anything in it is being exploited, which is the other half of the result.
What happens to the file
It is parsed in memory and discarded. Nothing about its contents is kept; the count of components read and the score are recorded, never a name. The security page says how the product handles an inventory you choose to keep.
No file yet? Generating one takes a minute. More on what the Regulation asks of an SBOM.
This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.