NEW: Build Arm / Keil SBOM with lynkctl
Features
Solutions
Resources
Company
Book Demo
Signup
The open standard for software supply chain component inventories, services, vulnerabilities, and attestations.
Open reference ↗
Short IDs like MIT or Apache-2.0 that SBOMs use to name a component’s license exactly.
One identifier format for packages in any ecosystem. Most tools rely on it to match components to CVEs.
NIST's naming scheme for vendors and products. The NVD uses it to say which software a CVE affects.
A Linux Foundation project and ISO standard for communicating software bill of materials information.
The current U.S. baseline for what an SBOM must contain. Seventeen fields, up from seven in 2021.
Where SBOM minimum elements started. Replaced by CISA's 2026 version but still widely cited.
Germany's detailed SBOM guideline on required fields, formats and dependency depth, written with the CRA in mind.
CISA's definitions of SBOM roles, terms and baseline attributes. A good place to start.
NSA's advice for teams that receive SBOMs and need to store, check and act on them.
India's national guidance on producing and sharing SBOMs and related bills of materials.
A CRA requirements checklist built on ISO/IEC 18974 and mapped to EU Regulation 2024/2847.
Full text of the EU law that puts SBOMs in the technical file for products with digital elements.
What FDA expects in a premarket cybersecurity submission, SBOM included, for devices under section 524B.
From the 2027 Windows release, each driver package needs its own SPDX 3 SBOM before Microsoft will sign it.
Read reference →
EU rules for essential and important entities, with supply chain security named as a required measure.
Requirement 6.3.2 asks for an inventory of your custom software and the third-party parts inside it.
Telecom's shared rules for SBOM content and format, so operators and suppliers exchange the same data.
Applies from 20 January 2027. Machine builders must identify the safety-relevant software they ship.
What vendors sign to confirm secure development practices before selling software to U.S. federal agencies.
The OASIS standard for machine-readable security advisories, also ISO/IEC 20153. Includes a VEX profile.
A small, simple format for saying whether your product is actually affected by a given CVE.
The minimum data any VEX statement needs, whatever format you publish it in.
NIST’s catalog of CVEs, with severity scores and CPE matches showing which products each one affects.
Google’s open vulnerability database for open source packages. You can query it with a PURL and a version.
Reviewed security advisories for open source packages across npm, PyPI, Maven, Go, Rust and more.
CISA’s list of CVEs being exploited in the wild. A useful first filter when deciding what to patch.
A daily score for each CVE estimating how likely it is to be exploited in the next 30 days.
Trusted by security and compliance teams at 100+ regulated companies
Interlynk automates SBOMs, manages open source risks, monitors suppliers, and prepares you for the post-quantum era, all in one trusted platform.
SBOM Automation
Open Source Management
Supplier Monitoring
Post-Quantum Readiness
LynkMCP
FDA 524B Compliance
CRA Compliance
Embedded C/C++ SBOM
Windows Driver SBOM
Guides
Blog
News
Docs
Open Source Tools
Comparisons
References
About Us
Contact
Privacy Policy
