ISO/IEC 5962 (SPDX)

SPDX SBOM format standard: document creation, package data, license expressions, completeness.


Short name	ISO 5962
Region	International
Country or scope	International
Sector	General
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ISO 5962

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for ISO 5962.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for ISO 5962 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ISO5962-FMT` Conformant Machine-Readable Format	The document must be produced in a standardized, machine-readable SBOM format (ISO/IEC 5962:2021 / SPDX 2.2.1 conformance)	Scan
`ISO5962-CL6-DOC` Document Creation Information	The SBOM must carry document identity fields including a unique namespace/identifier and the created timestamp (SPDX 2.2.1 Clause 6, Document creation information, incl. 6.5 and 6.9)	Scan
`ISO5962-CL6.8` Creator Field	The tool, person or organization that created the document must be recorded in the Creator field (SPDX 2.2.1 Clause 6.8)	Scan
`ISO5962-CL7-NAMEVER` Package Name and Version	Each package must have a name and should carry its version to be uniquely locatable (SPDX 2.2.1 Clauses 7.1 and 7.3)	Scan
`ISO5962-CL7-LIC` License Expressions	Packages should declare license information as SPDX license expressions (SPDX 2.2.1 Clauses 7.13 and 7.15, concluded and declared license)	Scan
`ISO5962-CL7.10` Package Checksums	Packages should provide cryptographic checksums enabling integrity verification of the described artifacts (SPDX 2.2.1 Clause 7.10, Package checksum)	Scan
`ISO5962-CL11` Relationships Between Elements	The document should express dependency and containment relationships between SPDX elements (SPDX 2.2.1 Clause 11, Relationships)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`SPDX-2.1`	SPDX Document Creation Information
`SPDX-3.1`	Package Information Completeness
`SPDX-3.7`	Package URL and External References
`SPDX-4.1`	File Information and Checksums
`SPDX-5.1`	Snippet Information
`SPDX-6.1`	License Expressions
`SPDX-7.1`	Relationship Information
`SPDX-8.1`	Annotation Information
`SPDX-COMP`	SBOM Completeness and NTIA Minimum Elements
`SPDX-HASH`	Cryptographic Hash Verification
`SPDX-FORMAT`	Machine-Readable Format Compliance
`SPDX-LIC`	License Identification and Obligations

Policy templates

Written for ISO 5962:

SBOM Creation and Management Policy (SPDX)
Open Source License Compliance Policy
SBOM Integrity and Authenticity Policy

And 22 from the standard set, adapted to ISO 5962.