# SBOM Format Reference
| Format | Standard | Tools |
|--------|----------|-------|
| CycloneDX | OWASP | syft, cdxgen, trivy |
| SPDX | Linux Foundation | syft, spdx-tools |
| SWID | ISO/IEC 19770 | Microsoft, NIST |

## SLSA Levels
| Level | Requirements |
|-------|-------------|
| 1 | Provenance exists (build metadata) |
| 2 | Hosted build, authenticated provenance |
| 3 | Hardened builds, non-falsifiable provenance |
| 4 | Two-party review, hermetic builds |
