Published sample — not live customer evidence

SBOM minimum-elements package check

Synthetic public sample. It shows how WitnessOps packages an SBOM check against the public CISA 2026 minimum elements baseline. It is not a live customer SBOM, not a compliance certificate, and not a vulnerability assessment.

Start a reviewVerify a receiptLibrary

Sample case

SBOM minimum-elements check

Situation: you received or produced a software bill of materials and need a bounded answer — which CISA 2026 minimum elements appear present, partial, missing, or unknown for one named software unit.

Type: Published sample packageStatus: Not liveChecklist: Partial with named gaps
Start a reviewView serviceOpen sample packageBrowse all examples

What this sample shows

  • A synthetic machine-readable SBOM for a tiny application.
  • Generation context: who authored it, which tool, and what was in scope.
  • A minimum-elements checklist with named present and partial fields.
  • How gaps stay visible instead of being smoothed over.
  • A receipt-style package a third party can re-hash and challenge.

What it does not show

  • CISA, federal, or third-party compliance certification.
  • That the software is free of vulnerabilities or known exploits.
  • Live customer or production SBOM authenticity.
  • Full AI-SBOM or multi-tenant SaaS coverage.
  • Production signing-key custody or supplier honesty.

Three-minute buyer walkthrough

  1. Step 1

    Open the package

    Use the GitHub sample folder for the full synthetic SBOM, checklist, receipt, and challenge path.

  2. Step 2

    Read the situation

    One named software unit — sample-app — with a tiny dependency set and intentional gaps.

  3. Step 3

    Check the checklist

    Document-level CISA 2026 fields are present; two component-level fields are partial with named gaps.

  4. Step 4

    Stay inside the boundary

    This is package shape and checklist observation only — not compliance certification or vulnerability status.

Present in this sample

  • SBOM author
  • Timestamp
  • SBOM tool name
  • SBOM generation context
  • Component name, version, and producer
  • Dependency relationships

Intentional sample gaps

These gaps are deliberate so the checklist can demonstrate partial coverage without inventing a clean bill of health.

  • gap-demo-lib@0.9.0

    Component license missing

  • license-only-lib@2.0.1

    Component hash missing

Public CISA baseline (reference only)

On 29 July 2026, CISA and partners published 2026 Minimum Elements for a Software Bill of Materials (SBOM), updating the 2021 NTIA baseline. This sample maps against that public baseline. It is not an official CISA artifact and does not claim compliance with CISA guidance.

CISA 2026 resourceCISA news release

Sample package lineage

Sample ID
SBOM_CISA_2026_MIN_ELEMENTS_SAMPLE_V1
Source repository
witnessops/witnessops-sample-cases
Package path
sample-cases/sbom-cisa-2026-minimum-elements
Pinned commit
8552357268a3
Open sample packageOpen hash manifestRead buyer walkthrough

Package files

  • ✓README.md
  • ✓BUYER_WALKTHROUGH.md
  • ✓AUTHORITY_MAP.json
  • ✓ACTION_BOUNDARY.json
  • ✓artifacts/synthetic_sbom.cdx.json
  • ✓artifacts/generation_context.json
  • ✓artifacts/min_elements_checklist.json
  • ✓EVIDENCE_MANIFEST.json
  • ✓RECEIPT.json
  • ✓VERIFY_RESULT.json
  • ✓CHALLENGE_PATH.md
  • ✓SAMPLE_DELIVERABLE_PLAN.md
  • ✓MANIFEST.sha256

Boundary note

This page is a published explanatory sample case and package presentation. It is not a live customer artifact. It is not a legal compliance claim. It is not a production deployment claim. It is not a claim of completed verification for your environment. The artifacts carry the inspectable detail; this page explains the situation and limits.

Start a reviewBrowse all examplesLibrary