Valid

GB/T 47020-2026Cybersecurity technology - Data format of the software bill of materials (English PDF)

网络安全技术　软件物料清单数据格式

Preview PDF

This is a limited preview

Buy now to download the full PDF (34 pages)

Need quotation for your management?

Get a formal quotation for GB/T 47020-2026 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

January 28, 2026

Implementation date

August 1, 2026

Scope

GB/T 47020-2026 is the English-translated version of 网络安全技术　软件物料清单数据格式.

GB/T 47020-2026 is the Chinese standard "Cybersecurity technology - Data format of the software bill of materials". Its scope clause reads: This document specifies the data format for the software bill of materials (BOM), including the composition of the software BOM, the file format requirements for the software BOM, and the software...

Bill of Materials elements, as well as the attributes and attribute value formats of each element in the software bill of materials. This document is intended to guide stakeholders in the software supply chain in generating, sharing, and using software bill of materials information. Its clauses include terms and definitions.

Found what you need?

Document preview — GB/T 47020-2026

National Standard of the People's Republic of China

ICS: 35.030
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Preface
1.Scope
2 Normative References
3.Terms and Definitions
4.Abbreviations
5.Composition of the Software Bill of Materials
6.Software Bill of Materials (BOM) file format requirements
7.Software Bill of Materials Elements
Appendix A (Informative) Required Elements and Fields for Software Bill of Materials
Appendix B (Informative) Example Reference for Software Bill of Materials
References

1 Scope

This document specifies the data format for the software bill of materials (BOM), including the composition of the software BOM, the file format requirements for the software BOM, and the software...

Bill of Materials elements, as well as the attributes and attribute value formats of each element in the software bill of materials.

This document is intended to guide stakeholders in the software supply chain in generating, sharing, and using software bill of materials information.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included.

For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies.

This document.

GB/T 25069-2022 Terminology for Information Security Technologies

3 Terms and Definitions

The terms and definitions defined in GB/T 25069-2022, as well as the following terms and definitions, apply to this document.

3.1 software products

Software embedded in computer software, information systems, or devices provided to users, or software used in the provision of computer information system integration and application services.

Computer software provided during technical services.

[Source. GB/T 36475-2018, 3.1.1]

3.2

A list of all components, files, and open-source code snippets included in the software, as well as internal and external dependencies and security information.

describe.

Note. The software bill of materials includes basic software information, software composition information, external dependency information, security information, and signature information.

[Source. GB/T 43698-2024, 3.8, with modifications]

3.3

Application services that are not inherent to the software itself and provide the necessary functions for the software to run via the network.

Note. External network services include domain name services, CDN services, email sending, SMS sending, push notifications, payment interfaces, and other services.

3.4 artifact

A physical component of information used or generated by a software development or maintenance process.

Note. Instances of artifacts include models, source files, text files, and binary executables. Artifacts constitute the implementation of deployable components.

[Source. GB/T 42560-2023, 3.1.1] […]

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 34 pages — is available in the English PDF.

Referenced standards

Normative references

GB/T 25069-2022Information security techniques—Terminology

How to Download GB/T 47020-2026

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.