| --- |
| title: README |
| emoji: 🐠 |
| colorFrom: blue |
| colorTo: indigo |
| sdk: static |
| pinned: false |
| short_description: CycloneDX is a modern standard for the software supply chain |
| --- |
| |
| # Welcome to the CycloneDX Community |
|
|
|  |
|
|
| OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. The specification supports: |
|
|
| * Software Bill of Materials (SBOM) |
| * Software-as-a-Service Bill of Materials (SaaSBOM) |
| * Hardware Bill of Materials (HBOM) |
| * Machine Learning Bill of Materials (ML-BOM) |
| * Cryptography Bill of Materials (CBOM) |
| * Manufacturing Bill of Materials (MBOM) |
| * Operations Bill of Materials (OBOM) |
| * Vulnerability Disclosure Reports (VDR) |
| * Vulnerability Exploitability eXchange (VEX) |
| * CycloneDX Attestations (CDXA) |
|
|
| The CycloneDX project provides standards in XML, JSON, and Protocol Buffers, as well as a large |
| [collection of official and community supported tools](https://cyclonedx.org/tool-center/) |
| that create or interoperate with the standard. |
|
|
| The project's website has many documented [use cases and examples](https://cyclonedx.org/use-cases/) |
| that provide a springboard to SBOM adoption. |
|
|
| The project operates as a [meritocracy](https://cyclonedx.org/about/governance/) |
| whose [guiding principles](https://cyclonedx.org/about/guiding-principles/) |
| reinforce its [risk-based approach to standards development](https://cyclonedx.org/participate/standardization-process/). |
| The project encourages [community participation](https://cyclonedx.org/participate/contribute) |
| in the development of the [standard and supporting tools](https://github.com/CycloneDX). |
|
|
| ## Background |
|
|
| Modern software is assembled using third-party and open source components. They are glued together in complex and |
| unique ways and integrated with original code to achieve the desired functionality. An accurate inventory of all |
| components enables organizations to identify risk, allows for greater transparency, and enables rapid impact analysis. |
|
|
| CycloneDX was created for this purpose. |
|
|
| Strategic direction and maintenance of the specification is managed by the CycloneDX Core Working Group, |
| is backed by the [OWASP Foundation](https://owasp.org), |
| and is supported by the global information security community. |
