The Linux Foundation hosts and governs the SPDX project, an open-source standard for System Bill of Materials (SBOMs) enabling license compliance, security, and supply chain transparency. It initiated SPDX in 2010, drives specification development (e.g., 3.0 in 2024), and facilitated its ISO/IEC 5962:2021 recognition
SPDX V3.X (in 2025) adds hardware, universal supply chain, security, AI-S, Functional Design, Business Operations, Cryptology, and compliance.
SPDX is an open source solution supported by key and strategic partners, contributors, and users.
SPDX is a graph language with an integrated ontology for universal data capture and sharing multidimensional information.
Information from multidimensional domains provides product information to define a supply chain, thereby generating compliance information.
The SPDX graph is the information format for compliance information. SPDX profiles point to required information in distributed data sources.
SPDX profiles provide the core information for risk mitigation and compliance of operational systems.
Supply Chain information is combined with operational information to build a comprehensive picture of systems, threats, and weaknesses.
Requirements to influence processes. Processes define actions. Actions are the execution of processes. Evidence is data that allows you to make an evaluation.
Regulations define requirements to mitigate risk and support compliance.
Policy defines requirements to define operations.
Requirement-based solutions are used to mitigate risk.
Solutions are used ot manage risk.
Businesses and governing bodies all work together to comply with the requirements needed to mitigate and manage risk.