A Survey on Mapping Digital Systems with Bill of Materials: Development, Practices, and Challenges

TL;DR

This survey reviews the development, practices, and challenges of using Bills of Materials (BOMs) across digital ecosystems, highlighting their role in dependency management, security, and compliance in complex systems.

Contribution

It provides the first comprehensive cross-domain review of BOM frameworks, practices, and challenges, and identifies key gaps for future research in digital supply chain management.

Findings

BOM frameworks have evolved through three stages with core principles and stakeholder roles.

Industry practices vary in BOM data generation, quality evaluation, and secure sharing.

Current BOM limitations include usability and reliability issues, especially in emerging domains.

Abstract

Modern digital ecosystems, spanning software, hardware, learning models, datasets, and cryptographic products, continue to grow in complexity, making it difficult for organizations to understand and manage component dependencies. Bills of Materials (BOMs) have emerged as a structured way to document product components, their interrelationships, and key metadata, improving visibility and security across digital supply chains. This survey provides the first comprehensive cross-domain review of BOM developments and practices. We start by examining the evolution of BOM frameworks in three stages (i.e., pre-development, initial, and accelerated) and summarizing their core principles, key stakeholders, and standardization efforts for hardware, software, artificial intelligence (AI) models, datasets, and cryptographic assets. We then review industry practices for generating BOM data, evaluating its quality, and securely sharing it. Next, we review practical downstream uses of BOM data, including dependency modeling, compliance verification, operational risk assessment, and vulnerability tracking. We also discuss academic efforts to address limitations in current BOM frameworks through refinements, extensions, or new models tailored to emerging domains such as data ecosystems and AI supply chains. Finally, we identify four key gaps that limit the usability and reliability of today's BOM frameworks, motivating future research directions.