Confirm which product and version the request covers, generate or pull the SBOM for that exact release, check it against CISA's 2026 minimum elements, send it through an access controlled channel, and log what you sent. Do it within the time your contract states, and ask counsel about confidentiality terms.
Why the request may arrive
OMB M-26-05 says agencies "may also choose to adopt contractual terms that require a software producer to provide a current software bill of materials (SBOM) upon request." It points agencies to CISA's minimum elements document for guidance. So the request is a contract matter: look for the clause and its exact wording before you act.
A seven step response
- Read the clause. Note the product scope, the delivery time and any format or confidentiality terms.
- Pin the version. CISA's document says each software version or update should have its own SBOM. Ask which release the agency runs, or confirm the current one.
- Pull or generate it. Use the SBOM produced for that build. Regenerating a new one for an old release can create a mismatch.
- Check the fields. The 2026 minimum elements include new items such as SBOM author signature, generation context, tool name and version, component hash value and component license. Compare your output to Appendix A of that document.
- Mark unknowns. The document says that if a data field is not provided, the author should say whether the information is unknown or withheld. A blank is worse than a labeled unknown.
- Choose the channel. CISA lists several ways to share: with installation, a version specific URL, an API, or a public repository. Access controls may limit sharing with unauthorized parties but should not block authorized ones.
- Log and follow up. Record date, recipient, file hash and version. Offer a contact for questions on redacted information, since the document says authors should have a process for that.
Formats
CISA's document names SPDX and CycloneDX as the two widely used formats. It tells organizations to accept widely used, interoperable and machine processable formats and to avoid accepting SBOMs for new software in deprecated versions of a format. If the contract names a format, use it. If not, offer one of these two.
Common pitfalls
| Pitfall | Better approach |
|---|---|
| Sending a repository dependency file as the SBOM | Send a proper SBOM in a standard format |
| Giving the latest SBOM for an older release | Match the SBOM to the release in use |
| Leaving fields blank | Label unknown or withheld |
| Emailing the file to a shared inbox | Use an access controlled link and keep a log |
| Sending a stale file because the pipeline is manual | Generate an SBOM at every build |
Cloud products
If you run a hosted platform, the memo's footnote says agencies should ask for an SBOM of the runtime production environment. Read what that footnote means and prepare snapshots tied to image digests.
Try it yourself
Click through it at your own pace, or open it full screen.
Check what an application inventory shows for each component and compare those fields with the minimum elements list above.
Quick check
Do we have to send an SBOM just because an agency asks?
Only if your contract has the clause or you choose to. Read the clause first and ask your contracts team.
Can we mark the SBOM confidential?
CISA says access controls may limit sharing with unauthorized parties. Put confidentiality terms in your contract or cover note.
Sources
Last reviewed: 19 October 2026.
