thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Software Package Data Exchange (SPDX)

An open standard (ISO/IEC 5962:2021) from the Linux Foundation for communicating SBOM information, including components, licenses and relationships.

Definition

SPDX originated for license compliance and is now widely used for security SBOMs. Version 3.0 adds profiles for security, AI and datasets. It is one of the formats accepted under U.S. SBOM minimum element guidance.

Example

A release includes an SPDX JSON SBOM listing every package, version and license.

Exam tip

Two main SBOM formats: SPDX (Linux Foundation, ISO standard) and CycloneDX (OWASP).

Related terms