# Vendor SBOM Checker

Paste or upload a vendor's CycloneDX or SPDX JSON file and check it in the browser:

- **NTIA minimum elements** -- the seven-element list FDA references for cyber devices (supplier name, component name, version, unique identifiers, dependency relationships, SBOM author, timestamp), checked element by element against what the file actually contains.
- **Vulnerability match** -- every component carrying a purl is matched live against Google's OSV database, with the vulnerability IDs, CVE aliases, severities where published, and links to the OSV records.

Nothing is stored: the file is parsed locally, the vulnerability queries pass through to OSV.dev, and no copy is kept. Components without a purl cannot be matched, and the checker says so -- the same gap the NTIA unique-identifier element flags.

Why this exists: FDA section 524B makes the SBOM a legal requirement for cyber device premarket submissions, and the EU Cyber Resilience Act requires a machine-readable SBOM in every product with digital elements. Receiving an SBOM is half the checkpoint; the other half is checking it.

What to do with a result:
- Is the vendor documented anywhere? Search the firm in the evidence-graded directory: https://vendorquals.com/tools/firm-visibility-check
- Make the vendor answerable -- the contract clauses that turn SBOM and notification duties into obligations: https://vendorquals.com/blog/vendor-contracts-breach-response-clauses
- FDA 524B submission in play? The scored readiness checklist: https://vendorquals.com/tools/fda-524b-readiness-checklist
- Send the structured RFP (medtech-524b or auto-unr155): https://vendorquals.com/rfp/medtech-524b

Source: https://vendorquals.com/tools/sbom-checker. This page is also served as HTML at https://vendorquals.com/tools/sbom-checker.