Supply Chain

What's your SBOM story? A four-sentence answer for startups

When a buyer asks for your SBOM story, a startup can answer in four true sentences. Here is the structure, a worked example, and what to attach.

What should you tell customers when your SBOM changes between releases?

Tell customers what changed, why, and whether any known issue was cleared or added. Keep it factual and version specific, with no promises you cannot keep.

What should you tell customers an SBOM does not show?

An SBOM lists components, not exploitability, quality, or fixes. Tell customers its limits up front, and point them to VEX and advisories for the rest.

What should a hardware startup give its contract manufacturer?

Send the factory a signed production image and a test plan. Keep signing keys, debug builds and your SBOM in house. Here is a simple handoff list.

What to say when a customer finds a component missing from your SBOM

A customer says your SBOM is missing a library. Thank them, verify, classify the cause, send a revised file and explain the fix. A reply plan with wording.

What do you say when a customer asks for an SBOM on a live call?

A 30 second spoken answer for live calls: what an SBOM is, what you can send, what you cannot promise, and how to follow up in writing the same day.

What do you say when a customer asks for a fresh SBOM at renewal?

At renewal, customers often want an updated SBOM. Confirm their version, send the matching file, note what changed and offer a refresh path.

What should you review when an SDK vendor changes owner or terms?

An SDK vendor sale or terms change can alter data practices and support. A short review list: data flows, privacy answers, contracts, support and exit options.

What should an AI bill of materials record for a dataset?

Record source, version, hashes, license, owner, collection date, transformations and approval for every dataset. A field list you can start with today.

What should you record about how a monorepo SBOM was generated?

An SBOM is only as trustworthy as its method. Record the tool, version, scan root, lockfile state and date so a reader can judge how complete it is.

What should you read in an action.yml before using an action?

Read the runs block first: it shows whether an action runs Node, a container, or shell steps. A short checklist for vetting a GitHub Action in minutes.

At renewal, what SBOM material should you ask a supplier for?

Renewal is a natural checkpoint. Ask for a current SBOM, any VEX statements, a summary of changes since last year, and the update commitment going forward.