What must the software bill of materials a manufacturer draws up cover, at minimum?

Why this is the answer

The floor is deliberately reachable: identify and document vulnerabilities and components, including by drawing up an SBOM in a commonly used, machine-readable format covering at the very least the top-level dependencies. Deeper transitive coverage is better practice and often necessary to answer a real incident, but the requirement sets the minimum rather than the ideal.