← ACARA Digital Technologies Years 9–10

Software bill of materials (SBOM)

A software bill of materials: a list of every component and library inside software, with version numbers, so each can be checked for known vulnerabilities.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 80

Understanding Software bill of materials (SBOM) in ACARA Digital Technologies Years 9–10

What it does: The list names every library used, which is the component list part of an SBOM. Knowing the exact version lets a team look up whether that version has a published vulnerability. A weakness is often found in only some versions of a library. The version number tells you if you are affected. Components you did not write still sit inside your software. An SBOM lets you spot the match and then patch. An SBOM does not block attacks. It helps you find out fast whether you are affected so you can act. SBOM stands for software bill of materials. It works like an ingredients list on a food packet.

Common mistakes: The SBOM component list is a dictionary of name and version pairs, so it must open with { to match the closing }. It should be sbom = {. Each component needs a colon between its name and its version number. It should be "requests": "2.31.0".

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Software bill of materials (SBOM) to a class →

This module's key terms are also in a printable crossword (Modules 828–859) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does an SBOM list?
Every component and library inside a piece of softwareOnly the passwords used by the software's developers
Matches
SBOM: flask, numpy, pillow
↓
The SBOM has no version numbers, so nobody can tell whether the versions used have known vulnerabilities. Add versions such as flask 2.0.1.
Applying
Meanings
Term
SBOM
Meaning
A software bill of materials: a list of every component and library inside software, with version numbers, so each can be checked for known vulnerabilities.
Practice
SBOM for ShopApp 1.0
Testing
Gaps
"": [
Check Answer
Spots
1sbom = [
2 "flask": "2.3.2",

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Sperm Whale' badge — Deep Sea Champion, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does an SBOM list?
A. Every component and library inside a piece of software ✓
B. Only the passwords used by the software's developers
An SBOM is a component list. It shows everything that was used to build the software, not just the code the team wrote.
2. Why does an SBOM include version numbers?
A. So the software looks more professional to customers
B. So each component can be checked against known vulnerabilities for that version ✓
A weakness is often found in only some versions of a library. The version number tells you if you are affected.
3. A library in your SBOM is listed as 'imagekit 2.1'. A vulnerability report says 'imagekit 2.1 can be hacked'. What should you do?
A. Check for a patched version and update the component ✓
B. Ignore the report because the library is not your own code
Components you did not write still sit inside your software. An SBOM lets you spot the match and then patch.
4. Which one is a good example of what an SBOM records?
A. logging-lib, version 1.4.2 ✓
B. The name of the programmer who was working late
A good SBOM entry names the component and gives its version, so it can be looked up in vulnerability lists.
5. A new vulnerability is announced in a popular library. How does an SBOM help?
A. It automatically stops attackers from reaching your network
B. You can quickly search the list to see if your software uses that library ✓
An SBOM does not block attacks. It helps you find out fast whether you are affected so you can act.

Match the Pairs

SBOM → A software bill of materials: a list of every component and library inside a piece of software
requests==2.19.0 → A component name with its exact version number, as it would appear in an SBOM entry
An SBOM is a component list, so each library inside the software is named → components: ["flask", "jinja2", "numpy"]
An SBOM records version numbers so a component can be checked for known vulnerabilities → numpy 1.16.0 -> check for known flaws
SBOM: flask, numpy, pillow → The SBOM has no version numbers, so nobody can tell whether the versions used have known vulnerabilities. Add versions such as flask 2.0.1.
SBOM: flask 2.0.1 (only the main app, no libraries) → The SBOM lists only one component. It must list every component and library inside the software, including the ones it depends on.

Key Term

SBOM
A software bill of materials: a list of every component and library inside software, with version numbers, so each can be checked for known vulnerabilities.

Fill in the Blanks

1. {"name": "my-app", "components": [ {"name": "flask"}]}
Hint: Type the key that holds the list of every part and library inside the software.
2. {"name": "requests", "version": "2.31.0"}
Hint: Type the key that records which release of the component is being used.
3. {"name": "flask", "version": "3.0.0"}
Hint: Type the key that identifies which component is listed.
4. sbom = ["flask 3.0.0", "numpy 1.26.4"] for item in sbom: print(item)
Hint: Type the variable name that holds the component list so each entry can be checked.
5. bad = {"log4j": "2.14.1"} if component in bad: print("Update needed!")
Hint: Type the keyword that tests whether a component is on the list of known vulnerable ones.

Spot the Error

Question 1
A sbom = [
B "flask": "2.3.2",
C "requests": "2.31.0"
D }
Line A — The SBOM component list is a dictionary of name and version pairs, so it must open with { to match the closing }. It should be sbom = {.
Question 2
A sbom = {
B "flask": "2.3.2",
C "requests" "2.31.0"
D }
Line C — Each component needs a colon between its name and its version number. It should be "requests": "2.31.0".
Question 3
A sbom = {"flask": "2.3.2"}
B for name in sbom
C print(name, sbom[name])
Line B — A for loop line must end with a colon. Without it, the loop that lists each SBOM component will not run. It should be for name in sbom:.
Question 4
A sbom = {"flask": "2.3.2"}
B version = sbom[flask]
C print("flask", version)
Line B — The component name is a string key, so it needs quotes. Without them Python looks for a variable called flask. It should be sbom["flask"].
Question 5
A sbom = {"flask": "2.3.2"}
B bad = "2.3.2"
C if sbom["flask"] = bad:
D print("Vulnerable")
Line C — A single = assigns a value, but an if needs a comparison. To check whether the version in the SBOM matches the known vulnerable version, use ==.

Student with a class code? Join your class →