Scoring

Is this SBOM complete enough?

Score any SBOM against the three major minimum-element frameworks — the question auditors and procurement teams keep asking. Each framework reports passed checks over total checks, plus an overall average.

sbomlyze image.json --compliance sbomlyze before.json after.json --compliance

2021 7

NTIA Minimum Elements

7 checks

Name, version, supplier, unique identifiers (PURL/CPE), dependency relationships, SBOM author, and timestamp.

Aug 2025 draft 10

CISA 2025 Minimum Elements

10 checks

Adds software producer, licence information, component hash, and tool name on top of NTIA.

v2.1.0, 2025 9

BSI TR-03183-2

9 checks

Requires component creator contact, SHA-512 hash, SPDX-format licences, and SBOM creator contact.

Score presentation

≥ 90%Complete

70–89%Minor gaps

50–69%Material gaps

< 50%Not fit for audit

--compliance --json includes the full report with per-check pass/fail detail; the HTML format embeds the compliance report into the report page.

Gating compliance in CI

compliance-policy.json

{
  "min_ntia_score": 85,
  "min_cisa_score": 70,
  "min_bsi_score": 80,
  "min_overall_compliance": 75
}

$ sbomlyze image.json --policy compliance-policy.json

Setting any threshold triggers compliance evaluation without the --compliance flag, so a single policy file covers drift, licences, and completeness.