GB/T 47020-2026Cybersecurity technology - Data format of the software bill of materials (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part

1.Structure and Drafting Rules of Standardization Documents". Drafting. Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents. This document was proposed and is under the jurisdiction of the National Cybersecurity Standardization Technical Committee (SAC/TC260). This document was drafted by: Information Center of the Ministry of Water Resources, Information Center of the National Energy Administration, Institute of Information Engineering of the Chinese Academy of Sciences, and China Southern Power Grid. Digital China Networks Group Information and Communication Technology Co., Ltd., Xi'an Jiaotong University, China Electronics Technology Standardization Institute, China Academy of Railway Sciences The Group's Electronic Computing Technology Research Institute, Hangzhou Moan Technology Co., Ltd., China Academy of Information and Communications Technology, and Tianyi Security Technology Co., Ltd. The company, Huawei Technologies Co., Ltd., JD Technology Information Technology Co., Ltd., Alibaba Cloud Computing Co., Ltd., and Shenzhou Netcom Technology Co., Ltd. Sangfor Technologies Inc., Ant Group Corporation, Guangxi Power Grid Co., Ltd., and China Construction Bank Corporation Limited Liability Company, Soft Security Technology Co., Ltd., Hangzhou Xiaodao Technology Co., Ltd., Shenzhen Open Source Internet Security Technology Co., Ltd., Hangzhou Anheng Information Technology Co., Ltd., National Computer Network Emergency Response Technical Team/Coordination Center, Zhejiang Provincial Water Resources Information and Publicity Center, Beijing Topsec.com Network Security Technology Co., Ltd., ZTE Corporation, China South-to-North Water Diversion Group East Route Co., Ltd., China Software Testing Center Chongqing Changan Automobile Co., Ltd., Yangtze River Water Resources Commission Network and Information Center, Kylin Software Co., Ltd., and Qi An Xin Wang Shen Information Technology Co., Ltd. Technology (Beijing) Co., Ltd., State Grid Siji Network Security Technology (Beijing) Co., Ltd., National Information Technology Security Research Center, China Southern Power Grid Technology The Institute of Science and Technology Co., Ltd., the Haihe River Water Conservancy Commission of the Ministry of Water Resources, and Suzhou Prism Colorful Information Technology Co., Ltd. The main drafters of this document are. Fu Jing, Zhan Quanzhong, Shen Zhibin, Zhang Chao, Zou Xi, Dai Yicong, Wu Tong, Liu Yuling, Jiang Zhengwei, Yao Yepeng, and Fan Zijing. Liu Jiahao, Wang Haijun, Liu Ting, Yao Xiangzhen, Wang Huili, Zhang Weilun, He Juan, Shen Xiyong, Meng Jin, Man Hongpeng, Lin Qian, Li Wei, Guo Xue, Wu Jiangwei Fang Yu, Liang Wei, Chen Kuiqiang, Liu Haijun, Zheng Weina, Tian Kai, Fang Qiang, Niu Mingzhu, Kong Yong, Bai Xiaoyuan, Cheng Yan, Xie Ming, Zeng Mingfei, Chen Defeng Wu Meng, Zhu Hui, Wu Juhua, Xu Feng, Fan Binghua, Wang Jie, Wang Jie, Shen Rongya, Wang Huibo, Lin Xingchen, Wei Jie, Luo Xiaolong, Kou Zengjie, Zhang Jinxin Yin Lingling, Yang Xu, Wang Xinlei, Yuan Wei, Sun Kangjian, Li Peng, Deng Ye, Li Xin, Wang Zhen, Dong Guowei, Zhang Chunguang, Li Zhiqi, Zhang Zhijun, Liu Hongyun Xu Chuanmao, Du Jinran, Zong Huali, Liang Dagong, Huang Haodong. Cybersecurity technology software bill of materials data format

1 Scope

GB/T 47020-2026 is the Chinese national standard covering the SBOM - the machine-readable list of every component and dependency inside a piece of software, with its versions, licences and suppliers, which is what lets an organisation answer within hours rather than weeks whether it is exposed to a newly disclosed vulnerability. At 22,500 words, first edition, and it is China's answer to SPDX and CycloneDX. It was issued on 28 January 2026 and has been in force since 1 August 2026, as a first edition. The document is under the responsibility of the Standardization Administration of China. This page is published from the official record of the 2026 edition; the clause text of a standard this recent is not yet in circulation, and the figures, limits and tables it contains are those of the document itself, delivered in full with the English translation.

This document specifies the data format for the software bill of materials (BOM), including the composition of the software BOM, the file format requirements for the software BOM, and the software... Bill of Materials elements, as well as the attributes and attribute value formats of each element in the software bill of materials. This document is intended to guide stakeholders in the software supply chain in generating, sharing, and using software bill of materials information.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included. For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies. This document.

GB/T 25069-2022 Terminology for Information Security Technologies

3 Terms and Definitions

The terms and definitions defined in GB/T 25069-2022, as well as the following terms and definitions, apply to this document.

3.1 software products Software embedded in computer software, information systems, or devices provided to users, or software used in the provision of computer information system integration and application services. Computer software provided during technical services. [Source: GB/T 36475-2018, 3.1.1]

3.2 A list of all components, files, and open-source code snippets included in the software, as well as internal and external dependencies and security information. describe.

Note. The software bill of materials includes basic software information, software composition information, external dependency information, security information, and signature information. [Source: GB/T 43698-2024, 3.8, with modifications]

3.3 Application services that are not inherent to the software itself and provide the necessary functions for the software to run via the network.

Note. External network services include domain name services, CDN services, email sending, SMS sending, push notifications, payment interfaces, and other services.

3.4 artifact A physical component of information used or generated by a software development or maintenance process.

Note. Instances of artifacts include models, source files, text files, and binary executables. Artifacts constitute the implementation of deployable components. [Source: GB/T 42560-2023, 3.1.1]