diff --git a/sbom.spdx b/sbom.spdx
new file mode 100644
index 000000000..ab3a8e60c
--- /dev/null
+++ b/sbom.spdx
@@ -0,0 +1,43 @@
+SPDXVersion: SPDX-2.2
+DataLicense: CC0-1.0
+SPDXID: SPDXRef-DOCUMENT
+DocumentName: coreMQTT
+DocumentNamespace: https://github.com/FreeRTOS/coreMQTT/blob/v2.1.0/sbom.spdx
+Creator: Amazon Web Services
+Created: 2022-10-13T22:44:13Z
+CreatorComment: NOASSERTION
+DocumentComment: NOASSERTION
+
+PackageName: coreMQTT
+SPDXID: SPDXRef-Package-coreMQTT
+PackageVersion: v2.1.0
+PackageDownloadLocation: https://github.com/FreeRTOS/coreMQTT/tree/v2.1.0
+PackageLicenseConcluded: MIT
+FilesAnalyzed: True
+PackageVerificationCode: c07601b177814b6822909121eb96644c56e8d3ed
+PackageCopyrightText: NOASSERTION
+PackageSummary: NOASSERTION
+PackageDescription: "Client implementation of the MQTT 3.1.1 specification for embedded devices.\n"
+
+
+FileName: ./core_mqtt.c
+SPDXID: SPDXRef-File-core_mqtt.c
+FileChecksum: SHA1: b37d2c127b39216b2dbff3c7667a4a9e3d866ab6
+LicenseConcluded: MIT
+FileCopyrightText: NOASSERTION
+FileComment: NOASSERTION
+
+FileName: ./core_mqtt_serializer.c
+SPDXID: SPDXRef-File-core_mqtt_serializer.c
+FileChecksum: SHA1: b506da9f4f2d706d5408ee8d8b9e778a9735f2c6
+LicenseConcluded: MIT
+FileCopyrightText: NOASSERTION
+FileComment: NOASSERTION
+
+FileName: ./core_mqtt_state.c
+SPDXID: SPDXRef-File-core_mqtt_state.c
+FileChecksum: SHA1: 4f8f310398bc088fe75b71bc16c80d2c7ec6e0cd
+LicenseConcluded: MIT
+FileCopyrightText: NOASSERTION
+FileComment: NOASSERTION
+