Comparison
CycloneDX vs SPDX
Two open standards dominate the SBOM landscape. Both satisfy the same regulations, but they were designed for different jobs. Here's how to pick — and why most mature teams end up producing both.
The short answer
- Pick CycloneDX if your first question is "am I vulnerable?" — richer security extensions (VEX, ML-BOM, CBOM), tighter fit with modern scanners, easier JSON.
- Pick SPDX if your first question is "can I legally ship this?" — deeper license and copyright lineage, ISO-standard, mandatory for many enterprise procurement flows.
- Produce both if you sell software to regulated buyers. The generation cost is near-zero and it removes friction from security reviews.
Field-by-field
| Feature | CycloneDX | SPDX |
|---|---|---|
| Governing body | OWASP | Linux Foundation (ISO/IEC 5962) |
| Primary use case | Security & supply chain | License compliance |
| Current version | 1.6 | 2.3 (3.0 in draft) |
| Serializations | JSON, XML, Protobuf | JSON, YAML, XML, tag-value, RDF |
| Package URL (PURL) | ||
| NTIA minimum elements | ||
| VEX (vulnerability exchange) | External (CSAF) | |
| ML-BOM (AI models) | ||
| CBOM (crypto inventory) | ||
| SaaS-BOM | ||
| License expression grammar | SPDX expressions | SPDX expressions |
| File-level detail | Optional | First-class |
| Snippet / copyright tracking | ||
| Regulatory acceptance | US EO 14028, EU CRA, FDA | US EO 14028, EU CRA, FDA |
Converting between them
The two formats share enough structure that lossy conversion is practical — PURL, versions, licenses, and dependency edges all round-trip. What doesn't survive are the format-specific extensions: CycloneDX VEX and ML-BOM statements have no SPDX equivalent, and SPDX snippet-level copyright lineage doesn't fit CycloneDX's schema. Convert once at the boundary, keep the source format as the artifact of record.
How sbom-tools handles both
sbom-tools reads and diffs CycloneDX 1.4–1.6 and SPDX 2.2–2.3 across JSON, XML, tag-value, and RDF/XML — so you can diff a CycloneDX release against an SPDX one and score either against NTIA, CRA, FDA, or NIST SSDF from the same command.
sbom-tools diff release-v1.cdx.json release-v2.spdx.json sbom-tools quality bom.spdx.json --profile ntiaSee all features