In August 2024 the Army's acquisition chief signed a memo directing acquisition staff to put SBOM delivery language into contracts for covered software. It is contract-driven: whether it applies to you depends on your contract, your software type and your subcontract chain. Confirm current terms with your contracting officer.
What does the memo say?
According to ExecutiveGov's report, Doug Bush, assistant secretary of the Army for acquisition, logistics and technology, signed the memo on August 16, 2024. It requires Army acquisition personnel to include contract language that requires vendors to produce and deliver software bills of materials for covered computer software.
The memo ties the requirement to supply chain risk management, saying that software is a subset of that risk and that it is to be managed across a system's lifecycle. The reporting says cloud services were not included.
What was the timeline?
The Army had 90 days to develop implementation guidance, including sample contract language and sample data item descriptions. After that, program offices had another 90 days to add the language, including for subcontractors. Federal News Network, as cited by ExecutiveGov, said the Army expected the rules in place by February 2025.
We could not confirm from primary sources what the final implementation guidance contains today, or whether the sample clauses changed after OMB rescinded M-22-18 and M-23-16 through M-26-05 in January 2026. Treat the memo as a starting point, then read your actual solicitation.
Who is a software vendor here?
Anyone delivering covered software to an Army program, directly or as a subcontractor. The reporting says obligations pass down to subcontractors that develop or deliver software. A component supplier two tiers down may receive the same requirement through a flow-down clause.
What should an SBOM contain?
The memo coverage does not list required fields, so look to your data item description. The common baseline is NTIA's minimum elements from 2021, and CISA has since published a draft 2025 version and a 2026 update. Your contract may name one. If it does not, ask which to use before you deliver.
A constructed example
A small firm builds a logistics scheduling tool and sells it through a prime contractor. The prime's subcontract adds an SBOM data item, due with each release, in SPDX or CycloneDX. The firm discovers its build produces a list from the package manifest only, missing a vendored parser and a base image library. The prime's reviewer finds the gap by comparing against a scan of the container. The firm switches to generating from the built image and resubmits.
How to check or apply this
- Find the SBOM clause or data item description in your contract and note the format, fields and delivery cadence.
- Ask whether cloud-hosted components are in scope for your product.
- Generate the SBOM from the final artifact in CI and archive it per release.
- Cover vendored code, container layers and statically linked libraries.
- Flow the requirement to your own suppliers and collect their SBOMs.
- Decide who in your company signs off on an SBOM and how corrections are reissued.
- Do not describe it as a blanket federal mandate. It is a contract term.
Safeguard can generate SBOMs and scan dependencies in CI. It does not make a product compliant with any Army or federal requirement.
What if my customer is not the Army?
The same habits help elsewhere. Other defense buyers, civilian agencies and commercial customers increasingly ask for SBOMs on request. A vendor that can generate an accurate SBOM per release answers all of them with one process. A vendor that builds a one-off document for each request pays the cost again every time and risks inconsistent answers between customers.
Quick check
Does the Army SBOM memo apply to every vendor?
No. It directs Army acquisition staff to add contract language for covered software. Your obligation comes from your contract and any flow-down clauses.
Are cloud services covered?
Reporting on the memo says cloud services were excluded. Check your solicitation, since terms can differ.
Sources
- ExecutiveGov, report on the Army SBOM memo
- OMB M-26-05 (PDF)
- CISA, Software Bill of Materials
- NTIA, Software Bill of Materials
Last reviewed: 18 October 2026.
