In 30 days, list suppliers and set up storage. In 60, run intake checks and review your first Tier 1 SBOMs. In 90, set refresh cadence, owners and a simple report. Aim to be able to answer "which suppliers ship this component?" within the hour, not to perfect every file.
Days 1 to 30: foundations
- List the suppliers whose software you run. Start from procurement and engineering inventories. Rough is fine.
- Tier them. Production and sensitive data first. Three tiers is enough.
- Pick a storage place. One folder or system, access limited, naming that includes supplier, product, version and date received.
- Name an owner. One person accountable for the process, even if part time.
- Send a short first request to Tier 1 suppliers. Ask for a CycloneDX or SPDX SBOM for the product and version you run.
By day 30, success is a list, a place, an owner, and requests sent. Replies will not all be in.
Days 31 to 60: intake and first review
- Define intake checks. Parse the file, confirm the seven NTIA data fields (supplier name, component name, version, other unique identifiers, dependency relationship, author of the SBOM data, timestamp), record the format and date.
- Match components against known vulnerabilities and note the findings.
- Review the first three to five Tier 1 files by hand. Use the findings to write follow-up questions. See the post on questions to send back after reading a supplier SBOM.
- Record gaps. Missing fields, flat lists, stale dates.
- Chase non-responders once, with a polite reminder and a date.
Days 61 to 90: cadence and reporting
- Set refresh rules by tier. The NTIA report describes frequency as a new SBOM for a new build or release. For Tier 1, ask for that. For lower tiers, a longer interval may be enough.
- Add the process to onboarding. New suppliers get the SBOM request before go-live.
- Run a drill. Pick a well-known component and see how long it takes to list suppliers that include it. Fix what slowed you down.
- Produce a one page status. Suppliers asked, received, reviewed, open questions, overdue.
- Schedule a quarterly review of tiers and open items.
What to measure
| Measure | Why |
|---|---|
| Tier 1 suppliers with a current SBOM | Coverage |
| Time to find a component across suppliers | Readiness |
| Open supplier questions past due | Follow-through |
Three numbers are enough. More invite debate about definitions.
Things that go wrong
The most common failure is waiting for perfect files. The NTIA report says consumers should be tolerant of incidental errors and that starting today beats waiting for perfection. A second is having no owner. A third is collecting files without a way to search them.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how stored inventories are rechecked as new advisories arrive, which is the steady state the plan aims for.
Safeguard's SBOM and dependency scanning can handle the matching step, and the free scan is at gold.safeguard.sh/scan.
Quick check
Do we need a tool before starting?
No. A folder, a naming rule and an owner will do for the first 30 days. A tool helps once you have more than a handful of files.
Which suppliers should be first?
Those whose software runs in production or handles sensitive data.
Sources
Last reviewed: 19 October 2026.
