Overview
ISO/IEC 5962:2021 - Information technology - SPDX® Specification V2.2.1 defines the SPDX (Software Package Data Exchange®) data model and standardized file formats for communicating metadata about software packages, files and code snippets. The standard specifies how to create an SPDX document (a Software Bill of Materials, or SBOM) that captures component identity, licensing, relationships and verification information in a consistent, machine-readable way.
Keywords: ISO/IEC 5962:2021, SPDX Specification V2.2.1, SPDX, SBOM, Software Bill of Materials, software supply chain, license compliance
Key topics and technical requirements
- Document composition and sections: defines required and optional sections such as document creation information, package information, file information, snippet information, licensing, relationships, annotations and review metadata.
- Conformance and profiles: describes conformance rules for current and previous SPDX versions, handling of obsolete features, and the SPDX Lite profile for minimal SBOM use cases.
- Field-level specifications: specifies essential fields used in SPDX documents, for example:
- SPDX version, document name, namespace and identifiers
- Data license and creator/created metadata
- Package fields (name, version, supplier/originator, download location, home page)
- File and snippet descriptors, file checksums and package verification codes
- Relationships between SPDX elements and other licensing information
- Standard data formats and serialization: defines how SPDX data is represented (the specification provides standardized notations and serialization options) and trademark compliance guidance.
- Traceability and verification: includes requirements for checksums and package verification codes aimed at enabling integrity checks and consistent provenance tracking.
Practical applications and users
- Software component inventory (SBOM): generating consistent SBOMs for internal asset management, procurement, and regulatory compliance.
- License compliance & legal review: automated detection and documentation of open-source license obligations and third-party component usage.
- Security and vulnerability management: mapping vulnerabilities to specific components and enabling rapid remediation across the software supply chain.
- Supply chain risk management & audits: auditors, compliance officers and security teams use SPDX documents to validate provenance and integrity.
- Tooling ecosystem: build, CI/CD, scanning and SBOM generation tools, package managers and vulnerability scanners implement the SPDX format to exchange component metadata.
Who uses it: software developers, DevOps engineers, security teams, license compliance/legal teams, SBOM tool vendors and auditors.
Related standards
- SPDX is commonly used alongside SBOM best practices and other SBOM formats (e.g., CycloneDX) to enable interoperable software supply-chain metadata exchange.